Technology Usage Policy Scenario Examples

Scenario One

Susan, a Kinesiology professor, uses her college-issued laptop for some personal work. Most recently, she took a couple family photos and used her college-issued laptop to store the digital images. If these images are stored on her college-issued computer, can the college access them? Does the college own them?

Such personal use of College Technology Resources is permitted as incidental. The images are Susan’s personal files, but since they are saved on a college-owned device, the college would have the right to access them if the college needed to search her device. This is just like a tangible personal item in one’s college office. If the college needs to search an employee’s college office, it has the right to view/access/search personal items stored on college property, but the college doesn’t own those personal items. In the same way, if the college needs to search one’s college-issued computer (or other college-issued technology device), it can access personal items/files stored on the device. But the college does not own those personal items/files.

Further, if Susan stored these files on her college-issued Google Drive account, the college would also be able to access those files if it needed to search her account. But the college does not own those files. The only reasons the "couple photos" would be accessed is due to either investigation of a personnel/technology behavior issue or during the normal processes of maintenance/repair/replacement. In either case, if the personal items were noticed to be in violation of a college rule or law, they would be reported/investigated themselves. But simply having a small amount of personal items present is not itself a violation and would not be a reason for the device to be accessed. It's important to note that "personal items" would NOT include items related to a non-Hope business venture or work on behalf of any other non-personal entity. Both of those are prohibited by policy and constitute violation of hardware/software licensing terms. It's also noteworthy that while the college does not own the items, the college is also under no obligation to ensure their ongoing survival (i.e., when the computer is updated or replaced) or transfer upon leaving the college.

Scenario Two

Adam is a Hope College employee, but is dissatisfied with some College policies and is actively seeking a new position. Using his personal phone in his office during lunch breaks, he has email correspondence with non-Hope colleagues about his job search using a non-Hope email account. This correspondence uses the Hope College network Wi-Fi. Can and will Hope monitor this communication?

When a personal device is connected to the college’s network all the traffic it creates and receives runs through the college’s firewall. That system logs every activity (millions and millions of events each day), including which sites a given machine visits. That is technically considered "monitoring" however that isn’t what most associate with the term. It might be possible to go back and correlate activity logged by the firewall to an individual's personal device. On occasion the college will do that for technical troubleshooting of student or college-owned devices, in which case it's easier to correlate the activity to the person because the college has the cooperation of the individual. It seems important to note that the same thing happens whenever an internet user connects to any network, including at home. One’s home internet is definitely "monitoring" internet activity and has the ability to track anything one does back to the user. “Monitors” are certainly using that information for targeted advertising and other "business-related" advantages.

The college is obligated (legally, contractually, etc.) to ensure that its network is used appropriately regardless of who owns the devices that access the network. In other words, the college needs to ensure that the ownership of the device isn't a loophole that would allow otherwise impermissible activity to take place without recourse.

The college would never ask to see or “seize” a personal device for inspection, even if the device has connected to the college’s network. During either maintenance/troubleshooting or forensic efforts, the college would be able to see that the personal device is connected and using the network, and may even be able to determine that email was being used. However, with those precise parameters and assuming that the individual has not linked their personal and Hope accounts, there is no ability to determine the contents of the email messages.

Scenario Three

Katherine is an instructor and was just terminated by the College. She leaves College premises and arrives at home. She immediately accesses her Google drive to copy the data she has collected in research and her access is denied. Confused, she checks her Hope email to see if she has received any information about her Google drive, but that access is also denied. When she tries to access her page on Hope’s website, she notices that is down as well. How can she obtain access?

The college has the right to “immediately and permanently restrict any/all further access” to all College Technology Resources once Katherine has been terminated. In addition, any services – such as web page service – that relies on these Google resources can also be restricted. These restrictions can be permanent at the College’s discretion.

Katherine can request that her data be transferred and delivered to her. The college is not obligated to grant this request but most often will. The college will grant this request unless it has a circumstantial reason not to do so. In some cases not all of the contents of the individual's email/files will be delivered to them (for example, information about specific student records, class rosters, and anywhere that other sensitive or protected data is involved). Thus, the transfer may involve Katherine meeting with a CIT or other college employee to go through the files and determine what is appropriate to be transferred.

Scenario Four

Amy, a Hope College employee, uses her personal Gmail account from her College-issued laptop to send an email complaining about her job to a friend. Would the college access her personal email?

Because personal use is permitted, College personnel would not read Amy’s personal Gmail messages. The only way the college would see the email message is if it ended up in a Hope College email account. This could occur if Amy has her personal account set up to automatically forward all messages to her Hope account, if the message was sent to a Hope account, or if it was sent to a personal account and was forwarded to a Hope account. Amy should know that once she sends an email—even if it is from a personal account—she no longer is the sole owner of the message and does not have control over what the recipient does with it. If the recipient received the email at a Hope email address (either directly or through their own forwarding that Amy was not aware of), then it is technically possible the college could access the message. Such access would be within the boundaries of college policy.

The only way that accessing Amy’s personal account would be possible is for the College to have possession of the college laptop AND for that device to still be logged in to the personal account. However, even in that situation the college would not access the personal account itself.

It's really important to understand that once someone sends an email, that message is no longer theirs. At best, it becomes a joint property between them and the recipient, and the recipient has full rights to determine who else obtains full rights. This isn't a Hope policy or decision, it's how email and similar correspondences work. If the recipient is a Hope address or if they are forwarding messages from a personal account to a Hope address, the recipient has (fully within their rights) determined that Hope is also an owner of the message.