EMail and Staff Storage Policy

[AngryITGuy]

My apologies if this is repeating a previous thread or indeed if this is in the wrong forum.

 

Basically I plan on tightening the relaxed rules my predecessor setup as after scanning the staff server for data it has been made apparent that staff are taking the P:censored::censored:S.

 

Scanning through profiles and home directories I found one user who was taking up 40GB of data on the server 24GB was in the home directory and the remaining 16GB was in the profile WTF

 

Others on the network are no better there are MP3's movies on the network all being downloaded by LimeWire. I am planning on introducing quotas on the home directories but wanted to know if any of you do this and what limits you set.

 

I have also been asked by the SMT to block access to any third party webmail as staff should only use the school provided exchange.

 

The SMT also want the emails monitored as many staff are sending emails during lessons and the SMT want to put a stop to this.

 

I know exchange has the message tracking function has anyone used this feature? I know it tells you the sender, recipient and subject of the email but I was more concerned about any legal implications this may have.

 

Any thoughts and comments would be greatly appreciated.

[ranj]

I am in a similar situation to you. I have a few staff who are reaching levels of 16Gb. I appreciate that with the demands of curriculum new ways of teaching with video and audio demand gigabytes of files but to have so many. The question to ask is are they being used and the answer is probably hardly likely.

 

Why don't you ask your SMT team to allow you to have full access to everyones mailboxes and this will allow you to view any suspicious staff email accounts and to investigate further....

 

The messenging tracker would allow you to see what emails went out per day on your email server, so that is another way of investigating all emails going out and you'll be able to identify external emails going out just by looking at the email addresses.

 

I myself would like to send an email out to staff at my own school with big areas. I have had a look at a few and some of them do have files that are NOT school related but unsure how to phrase the email. If anyone can offer any suggestions that would be greatly appreciated.

 

I just want to make the point that disk space is at a premium, and everyone needs to be responsible with regards to disk space. If anyone has sent out an email to their own staff, Please offer any suggestions. That would be greatly appreciated...

[srochford]

I think there are several separate matters here.

 

if staff have home directories with even just a few illegal music, video files etc then you are right to clamp down on this - an email on the lines of "please note that you must not use the school network to store music and video which is not the legal property of the school. Music "ripped" from CDs is not legally owned and should not be on the network and will be removed."

 

If staff have large files because they are creating lots of worksheets with images in them then you need to consider whether you can provide more storage or offer training on how to make file sizes smaller (we had a situation where a group of staff were making documents with the college logo in them; they'd somehow got this as a massive bitmap and each 1 page Word file was 10Mb. Showing them how to link an image got the file sizes down to something much more sensible)

 

It might be that you need to add more storage to the network - 750Gb SATA drives are £50 so it's easy to add more space for things like worksheets which are perhaps needed once a year.

 

You've then got the issue of potential abuse of email. You must not start generating reports of who sends email to whom just to see if anyone is mis-using the system - you run a serious risk of laywers tearing you to pieces if you do this (even if told to do so by your manager). What I think you can do is respond to a manager who says "person X does not appear to be doing their job properly. They claim that they only send 1-2 emails per day. Is this true?"

 

Webmail is another issue. If the school has a policy that staff must not use the internet for personal purposes then I'd guess it's OK to block access to webmail (but a policy like that is pretty unreasonable)

 

Ultimately, the staff are paid to do a job. If they're not doing their job properly (whether it's because they're surfing the web all day or sitting reading the paper) their managers should be chasing them up to make sure they do the job

[Jay]

I don't have the full list on this machine to hand but I've got a list of items from our legal team (Norfolk CC) that I needed to cover for our email system. You have to start thinking about data retention policy, for example data protection laws require you to store 6 months worth of message logs* (who sent what and when). You should also have a written policy regarding placing a hold on an email account or freezing messages when requested by the courts. Exchange 2007 has some of this functionality built in I know and a lot of it is just manual stuff but pretty important still.

 

J

 

*Not the message contents, thats not covered (yet).

[FN-GM]

Off topic but why are they allowed to use limewire in school?

[srochford]

Off topic but why are they allowed to use limewire in school?

 

Actually, I don't think it is off topic - this is the sort of thing that you should look at because, essentially, what you're looking at is all part of an acceptable use policy - is it acceptable, for example, to store 40Gb of stuff on the network completely depends on what that 40Gb contains. I can think of very few legal uses of limewire for the majority of staff so I wouldn't allow access to it.

 

On the other hand, using webmail generally wouldn't be seen as unacceptable and I'm not sure that you can justify a global ban.

[powdarrmonkey]

On the other hand, using webmail generally wouldn't be seen as unacceptable and I'm not sure that you can justify a global ban.

 

At the risk of all-out war, that's surely up to the school? It's their network and internet connection, and their choice as to what is accessed. Just because the staff have had it easy for a while doesn't mean it can't be changed.

[Geoff]

On the other hand, using webmail generally wouldn't be seen as unacceptable and I'm not sure that you can justify a global ban.

 

The only way you could do it is if you provided an inhouse system (Exchange/Zimbra/etc) and require everyone to use it. Data Protection is an obvious reason to require staff to use the in house system. Monitoring for Cyber Bullying is an obvious reason to require pupils to use the in house system. I'm sure you could think of more reasons.

[pallen]

To be honest, what the network is used for is completely up to the school and its AUP. If it states that there is to be no use of webmail (as ours does)then it should not be used. So long as all staff and pupils are provided with inhouse access to email there is no need to access hotmail etc. As for storage, as someone has already pointed out, it depends on what the users are storing, if it is illegal content, it just gets deleted(you can inform the users so they can remove it themselves if your feeling nice) If it is work related then it probably a training issue.

 

It sounds like you need to update your AUP to tighten up your security and update staff use of your network. If you could get this done before the summer it would give you the summer to implement any changes that you make.

Edited July 1, 2008 by pallen

[srochford]

The only way you could do it is if you provided an inhouse system (Exchange/Zimbra/etc) and require everyone to use it. Data Protection is an obvious reason to require staff to use the in house system. Monitoring for Cyber Bullying is an obvious reason to require pupils to use the in house system. I'm sure you could think of more reasons.

 

It's often seen as reasonable that employees can make personal use of work facilities (such as the internet access) provided that their use does not adversely affect other people (so personal web mail before or after work is fine; downloading huge files of any kind at peak time is not fine)

 

Once this has been in place for a reasonable period of time, I think that it becomes part of the "benefits package" and just taking it away would be frowned on by the courts if someone decided to challenge it (unless, of course, it was agreed to by all members of staff who would be affected)

 

If, on the other hand, an employer says "you can use your work email for personal purposes" then it may be reasonable to ban access to webmail systems but I still think that it's unnecessary. Of themselves, they needn't cause a problem; it's abusing them that is a problem and that's a whole different issue.

[Domino]

for my tuppence worth, I quite often found that yes, teachers would prefer to use the inhouse exchange system - but we quite often had trainees/students in, and they would require webmail to contact tutors etc.

 

Of course, with a tiered web filter you can adjust it per AD group.

 

...however limewire (or any P2P for that matter) is fairly shocking if its being allowed.

[powdarrmonkey]

Limewire on a school network is frankly dangerous.

[Domino]

On the storage front, maybe set up central areas for each department to have shared video/music/images, then it can be more tightly controlled.

 

You could also then restrict filetypes that can be stored in users home directories, so that media files must be stored in a central location. could cut down on replictaion too.

[ITWombat]

Once this has been in place for a reasonable period of time, I think that it becomes part of the "benefits package" and just taking it away would be frowned on by the courts if someone decided to challenge it (unless, of course, it was agreed to by all members of staff who would be affected)

 

So if I understand you correctly, an employer bares all the cost and liabilities of employee use of a company's email system but cannot specify how it is used?

 

Are employers now required to provide personal email and web access to employees?

 

Is it a case of if you don't take steps to mark out the boundaries of your back garden then a right of way can be established merely by custom?

[AngryITGuy]

Thanks for the numerous and helpful posts people.

 

Perhaps some background info would help shed more light on my situation. I have not been at my current position long, network manager before me left before he was sacked.

 

As far as I can tell there was no staff AUP, well not one staff have to sign. I have just finished putting one together.

 

The policy is pretty basic in its structure and is similar to many posted on here. It tells staff that all internet and email traffic will be monitored and that the user’s history will only be looked through in detail should the school/SMT receive a complaint about a member of staff from a student/visitor/other member of staff. Just to cover my back it even goes on to say that when the report regarding the use history is created a member of the SMT has to be present and the generation of the report has to be documented. I have tried to make it as transparent as I can to show staff I have no intention of checking up on them just for the sake of it as I have more important things to do with my time.

 

Sent it out to staff for comments and most have come back and said they will refuse to sign it and they have threatened to go to the union regarding the changes being introduced.

 

Staff here pretty much run the show, they install what they want, store what they want and surf the internet when they want looking at what they want. We have recently had BLOXX installed which will filter and monitor staff internet access from September, this was not received well by staff.

 

Staff have a home directory, a department directory for documents and a department directory for media resources yet most people just save everything to either their home directory or desktop. This is problem is down to staff training and I hope to get this resolved with some training sessions to staff.

 

For those of you who asked LimeWire was already running before I started and breaking the habit has been difficult, although BLOXX should put an end to that. Webmail has been blocked as staff have access to our internal exchange server. The network since I have been here has been taken down twice by a virus once during OFSTED, both were "inadvertently" downloaded from webmail by staff.

 

I am currently the bad guy at school as I dare to tell staff what they can and can't do and I dare to introduce change.

 

Staff have pretty much stopped talking to me since I told them their internet access will be monitored, but I don't care the place needs policies putting in place and the staff need to be reigned in.

 

Staff have even gone to the extreme of not using the exchange server as there is a rumor doing the rounds that I have been instructed by the SMT to read all emails sent by all staff.

 

I guess it’s true what they say about POWER IN NUMBERS and all that I am not sure what the SMT will be forced to do if all staff refuse to use the internal exchange and refuse to sign the new AUP.

 

Sorry about the RANT but its late and it's not long before I have to be up again to go and face the mob.

[Jay]

Might be worth having some sort of workshop where both you and the SMT can explain the facts of life to your staff. I'm sure that with good reasons for what you're doing the majority will accept the need for change. Worth checking with your SMTs first though.

 

I would guess your Offsted probably pointed out that IT wasn't a strong area given what you have said. You could indicate to your staff the failure in this area is one good reason for change. It's my experience that offsteds seem to scare the bejesus out of most teachers.

 

There is an AUP here that might be of use: Acceptable Use Policy (two links within) . It's fairly old and in need of updating but the principles should be the same.

 

J

[Hollie1985]

If staff suspect there email usage patterns are being monitored then 9 times out of 10 this will reduce email misuse we have found, once you have warned staff verbally and in the form of an email from SMT to warn this is happening..you should see an improvement.. you have full rights to monitor email to the body of the mail and some email archiving companies (Gartner Quadrant approved) have been known to stand up in court to represent their mail products in any email related issue

[G-Jackson]

We are currently looking into the use of 3rd Party Webmail because even though we have a School webmail system provided by EMBC our ISP alot of staff don't use it.

 

Our Deputy Head asked us to block Hotmail which has caused a bit of an uproar in certain depts - however he still uses his own externaly hosted e-mail

 

BECTA does recommend that schools should not use external webmail but as far as I'm aware our LA has no policy and neither does the school - although our new Network Manager is looking to introduce one.

 

I personally feel that all members of staff should use the school's e-mail full stop - I've never worked at a company where they would allow employees to use hotmail etc

 

1. It's unprofessional - I'm sure you wouldn't want to receive an e-mail from your doctor if the e-mail was bigdave@hotmail....

 

2. It's not secure - they could be e-mailing confidential information about students and that information could be stored on servers anywhere in the world and be accessible by god know who.

 

At the end of the day, the teachers are employees (as SMT are) the Governing Body should be the ones who say what goes (following LA and Government Guidelines)

If teachers won't sign the AUP then they shouldn't get access to the network and if that means they can't do their job then they should leave.

[Great_Scott]

We are very keen at our school to clamp down on what staff can and cannot do on the network. If they do not sign the AUP they do not get access. I do allow webmail access and other personal use but the AUP states that all network activity and use is monitored. We regularly brief staff on changes and policy specifics, we just have to ignore the moans, groans and whispers from the corners and accept that us IT staff are often loathed.

 

We still have staff taking liberties though and although it really winds me up I go and talk with the person causing the problem and make it clear that in a corporate environment they wouldnt get away with it, if that doesnt work I go straight to SMT who I'm pleased to say are on my side most of the time, I'm very fortunate in that respect.

 

We have a detailed and lengthy AUP which I'd be willing to share directly with those who are interested, as for Limewire, remove it immediately and tell the objectors your reason is because it is the primary distribution source for child related pornographic material - just run a search for Amy Winehouse content and you'll see what I mean and like Hollie wrote, you have every right to monitor what is happening on your network, otherwise how can you do your job?

[G-Jackson]

I'd love to see a copy of your AUP to pass on to my Boss.

[mac_shinobi]

Think there is a bit of software you can purchase to install on the server that will stop users writing to there home areas if they go over there quota but I also know you can do that on a server OS without that but for the life of me cant remember the name of the software and would be nice to find out what it was

[Hollie1985]

I would also like to see a copy of the AUP i know a few schools who would be interested in seeing this :-)

 

The only name of a product i can think of it could be is one called Insight i'm sure there are others

[G-Jackson]

If you're running MS Server you can just use the built in Disk Quota - you need to Enable Quotering on the disk and then set it up for the users... we just Quota our students but Staff are going a bit stupid now so we might start restricting them too.

[Theblacksheep]

If you're running MS Server you can just use the built in Disk Quota - you need to Enable Quotering on the disk and then set it up for the users...

 

Not any old MS server... Needs to be 2003R2 or above.

 

With that tho you can also do file screens for home areas and keep (legal) "teaching resouces" on a shared area.

[G-Jackson]

Hi blacksheep - True but I didn't think anyone would be using anything less... we don't have a massive IT budget and we've been on Server 2003 for ages. I expect we will remain their for some time to come.