Now that all residence
hall rooms are linked to the powerful University Ethernet network, some
students are finding imaginative—and sometimes illegal—ways
to take advantage of the network’s power, using their laptops and
personal computers. 
Some of these uses may violate the University’s Acceptable Use Policy for Information Technology or the Residence Services’ “ResNet” Acceptable Use Policy. (Can’t you just hear your student saying, “No big deal.”?) But it can be a major big deal. A violation can bring University sanctions, including loss of user privileges for a definite or indefinite period, a formal reprimand, probation, suspension, or expulsion from the University. Some actions also may violate Iowa or federal laws that carry potential prison terms or fines.
Recently, one student illegally hacked into a private motion picture company web site and tried to download the movie Hannibal to his personal computer. That violated copyright law, state laws, federal law, University information technology policy, residence halls policy…and that’s not even including what it did to the network.
“From
my perspective, this is serious stuff,” says Jane Drews, senior system
administrator in Information Technology Services. “It’s not
just kids playing around. Stealing from business (as in the Hannibal download
attempt) is serious, and businesses will be very serious about it. Furthermore,
you can’t very well try to download a full-length feature film that
has a great big FBI notice on it forbidding reproduction and then say
you didn’t know it was wrong.”
Drews is the University’s legal agent for computing at the University, so any complaint against a student, faculty member, or staff member comes to her.
“We locate the machine on which the infraction occurred and we take expeditious action to inform the owner that this action is a violation. We ask them to take the offending material down, and if it isn’t done, we turn off the network port to that student’s residence hall room,” she says.
“If we ignored a complaint, the company could take action against us as well as the student,” Drews says. “So we don’t ignore them.”
An accused person has the opportunity to rebut once an official complaint is filed, and the University also replies to the complainer. But as soon as the University replies, it is no longer part of any legal action. Any civic or criminal legal liability arising from the action of the student continues against the student alone, Drews says.
Education Is Better
While Drews will move swiftly to investigate misuse of the University’s network, she says she is less eager to prosecute wrongdoers than to educate students so they’ll know better than to violate the law.
Drews says that when they’re caught, students always say, “I didn’t know….” or “A friend told me it would be OK to do it.”
“But responsible use means that students who use a network must know what their use may do to it,” she says.
Drews also wants students to know the risks of being connected on the network.
“I’d like them to know computer ethics,” she says. “I’d like them to be aware that nothing that they do on a network is private—they may think they’re chatting only with one person, but it has the potential of being read by 500 other people. A direct connection is different from a dial-up connection, and it makes you much more of a target, especially if you leave your computer on all the time,” she adds.
Four Potential Problems
1) Copyright infringement—this varies from downloading music from a web site without paying for it to copying logos, photos, or words from other web sites without attribution or permission. “Just because you can do it, it
doesn’t mean you should,” Drews says. “You can face legal action under the Federal Millennium Digital Copyright Act.”
2) Messing up ResNet or the University’s network—anything that interferes with the proper functioning of the University’s information technology system: viruses, e-mail spam, use of software tools to attack the system, use of “sniffer” programs that seek out packets of information being sent on e-mail, or violation of security standards.
3) Excessive personal use of the system—attaching dozens of computers and peripherals to a residence hall port, using up too much bandwidth, running a computer-intensive small business from a residence hall room, downloading huge bandwidth games and playing them on the network with friends also may not be acceptable.
4) Inadvertent downloading of viruses or network attack mechanisms—“We have site-licensed antivirus software that students may download and use,” Drews says. “It’s free. We strongly encourage all network users to use antivirus protection any time they insert a disk from outside or receive an e-mail attachment.
“If they download a game, they should be very careful to download it only through reputable sources,” she says. “We have a number of machines that have had ‘back-door’ programs installed by game software. These programs bring in a program that antivirus software won’t pick up, and it means that the computer on which they are installed will begin to attack the whole network without the student’s knowledge. We have found three or four of these programs on residence hall computers. These attack programs can just trash a hard disk.”
How to Get Help
If it happens to students, they should call the ITS Help Desk. For some of the problems, it’s as easy as uninstalling the program and deleting it, but others are more complicated. They also can go to www.uiowa.edu/~security and find links to free firewall software.
While Drews must act swiftly to find student law- or policy-breakers, she knows how easily students can get themselves into trouble. Recently when she came home from work, her own children greeted her with, “Mommy, you have to see the neat game we downloaded.”
“Where did you find it?” she asked.
“I don’t know, some site,” was the response.
Fortunately, the Drews family computer was safe—and she used education to make sure the problem wouldn’t happen again in her family.
By Anne Tanner