Agency Computer Systems Policy

• This order consists of the following: Purpose, Policy, Definitions, Procedures

Purpose

• This policy establishes procedures for member use of agency computer systems

Policy

• The Osceola Sheriff's Office regulates the use of all Computer Hardware and Software owned, purchased, grant-funded, donated, or leased by the Osceola County Sheriff's Office or the Osceola County Board of Commissioners and used by this agency's members
• Regulation extends to a member's use of any non-agency Computer, or Personal Communication Device while on-duty or while acting as an agency representative
• Members have no expectation of privacy in any Computer activities on agency Computers, any other Computers, or Personal Communication Devices while acting as an agency representative

Definitions

• Advanced Authentication (AA) provides greater security to the usual user identification and authentication of login ID and password, such as a biometric system, proximity card, smart card, PIN, or password
• Business Day is Monday through Friday, excluding approved Sheriff's Office holidays
• Chain Messages are emails that have been transmitted broadly and/or forwarded concerning subjects that do not relate to official agency business
• Computer is a programmable electronic machine that can store and retrieve data, perform high-speed mathematical or logical operations or that assembles, correlates, or otherwise processes information (e.g. laptops and Personal Communications Devices)
• Confidentiality Notice is an addition to the end of an email expressing the material contained in the message is covered by F.S.S. 119, and that if the receiver is not the intended recipient, they are compelled to contact the sender and destroy the material received
• County Information Technology Services (County IT) is a department of Osceola County government that is responsible for network and internet access for all agency facilities
• Criminal Justice Information (CJI) includes information provided by the FBI including but not limited to biometric data, identity history, person, organization, property, and case/incident history data
• CJIS (Criminal Justice Information Services) refers to Federal information security requirements for protecting the sources, transmission, storage, and generation of CJI
• Digital Certificate is a Computer data file used to validate a user's access to prevent unauthorized access, using an exchange of encrypted data to gain access ELVIS stands for Electronic License and Vehicle Information Database
• Email System refers to software that permits sending and receiving correspondence, contains folders for email storage, and a calendar for scheduling
• External Memory Storage Devices include various devices for storing data including but not limited to external hard drives and USB flash drives
• Florida Criminal Justice Network refers to a limited-access Website operated by the Florida Department of Law Enforcement that provides various resources and database access to criminal justice agencies (http://www.flcjn.net)
• Hardware includes all electronic components of a Computer system including peripherals, circuit boards, and input and output devices; tablets, smart phones, or similar devices are considered Hardware, which must comply with this policy
• Information Management Services (IMS) is a unit of the Osceola County Sheriff's Office that is responsible for administering and maintaining Hardware components and Software applications for the Osceola County Sheriff's Office and The IMS Director or designee shall notify all Computer users the procedure to contact the on-call member of the IMS unit
• Instant Message is an electronic way to perpetuate a written conversation between users without delay
• Intranet refers to a local or restricted communications network, especially a private network created using World Wide Web Software
• Logon is the unique identifier assigned to each User Account, which usually indicates the name of the person to whom the account is registered
• MiFi Hotspot is a portable broadband device that allows multiple end users and mobile devices to share a 4G or 5G mobile broadband internet connection and create a mini-local network
• Mobile Data Computer (MDC) is a commercial grade mobile computer operating in a law enforcement vehicle or otherwise are not connected via a local or wide area network but are capable of accessing system servers via a CJIS compliant connection
• Password consists of a string of characters, either alpha and/or numeric, created by the account user, which is required, along with a username, in order to access a User Account
• Personal Communication Device includes all cell phones, pagers, personal e-mail devices, personal digital assistants, smart phones, “tablet” style Computers and other similar devices
• Personally Identifiable Information (PII) is information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother's maiden name
• Security is any system designed to safeguard physical or logical access to personnel, information, or element which are designated an asset or responsibility of the agency
• Server(s) consists of a high-capacity Computer that stores and retrieves data
• Software refers to a Computer program; which is a set of instructions written in a specific language for the Computer to perform various operations on data contained in the program or supplied by the user Transitory Message is informal communication of information, created primarily to communicate information of short-term value; examples include reminders to employees of scheduled meetings/appointments
• User Account is an account established for agency personnel used to securely access systems provided by the agency or external resources; authorized agency personnel shall have a username and Password for accessing such accounts
• Website refers to any Computerized document, file, or menu accessible on the Internet, Intranet, and/or World Wide Web
• Wireless Access Point (WAP) is a device that allows wireless devices to connect to a wired network using Wi-Fi, Bluetooth or related standards; the WAP usually connects to a router and can relay data between the wireless devices such as Computers or printers and wired devices on the network

Procedures

• Any access to and/or use of any agency or personal Computer, agency Server, Personal Communication Device and/or Personal Identification Information shall be in accordance with FSS 817.568
• Improper use or unauthorized access of agency Computers, Digital Certificates, systems or networks, whether on-duty or off-duty, or any non-agency Computer or device while acting as an agency representative, subjects the user to progressive discipline, up to and including termination; improper use includes but is not limited to activities such as:
  • Commercial activities, ventures, and/or profit-making purposes
  • Creating, displaying, viewing, retrieving, or transmitting threatening, racist, sexist, sexually explicit, or suggestive, obscene or harassing language or materials, except when done with command level approval for law enforcement purposes such as covert investigatory operations
  • Playing games using an internet-based application or other Software programs
  • Copyright and licensing violations
  • Violation of personal privacy
  • Vandalism and mischief that incapacitates, compromises, or destroys agency resources and/or violates federal and/or state laws
  • Watching media solely for entertainment
  • Using email or Instant Message systems to create offensive or disruptive messages or any message containing sexual content, racial slurs, gender-specific comments, or any other comment that offensively addresses someone's age, sexual orientation, religious beliefs, national origin, or disability
  • Using email or Instant Message systems to facilitate commercial ventures, religious or political causes, outside organizations, or other non-job-related solicitations
  • Creating, forwarding, or perpetuating Chain Messages
  • Releasing CJI to unauthorized persons

Hardware and Software

• All Hardware and Software owned or used by the agency must be used according to copyright laws and manufacturer's recommendations
• Only agency-approved Hardware should be used by members on any agency Computer
• Members whose assignments require the sharing of Computer terminals must log on under their own username and Password
• Members wishing to use Hardware that is not agency Hardware shall request permission via chain of command from their section lieutenant/manager.
• The section lieutenant/manager acquires a recommendation from IMS and then forward the request and recommendation to their Division Captain for approval.
• Support and maintenance of personally owned Hardware is the sole responsibility of the owner and shall not be supported by IMS
• Any damage to any non-agency Hardware is the owner's responsibility, and the owner will not be compensated in any manner for the damage
• All unbudgeted Hardware requests shall be made by inter-office memorandum through the chain of command to the requesting member's captain or equivalent
• A copy of the memorandum shall be provided to the IMS Director
• No Computer Hardware shall be installed, opened, modified, repaired, or moved except by the IMS Unit or at its direction
• The loss or theft of any agency communications device issued by IMS shall be reported to the IMS unit immediately and include a completed Accident/Loss Report (form#SO-03-01) consistent with policy 247.0, Field Reports, forwarded via chain of command for administrative review
• Communication devices issued by IMS include, but are not limited to: Air card or Sim card, MiFi Hotspot device, Body Cam Device, Cellular Device Mobile Data Computer (MDC), Any device IMS has provided a cellular connection

External Memory Storage Device Policy

• External memory storage devices not purchased or provided by the Sheriff's Office or another governmental entity shall only be used with approval from an IMS supervisor or higher authority
• Members shall request approval via email
• External memory storage devices must be periodically scanned by the user for viruses prior to use in an agency Computer
• All External Memory Storage Devices must meet standard equipment requirements as set by IMS
• Prior to use, the External Memory Storage Device(s) shall be encrypted utilizing the encryption Software pre-installed on agency Computers (e.g. Bitlocker)
• Any lost or stolen External Memory Storage Devices shall be reported to IMS as soon as possible.

Software

• Only agency-approved Software shall be used by members in agency Computers
• Members wishing to use Software that is not agency Software shall request permission from their section lieutenant/manager and the section lieutenant/manager will obtain a recommendation from the IMS Unit, and then forward the request and recommendation to their Division Captain for approval
• Any upgrades and/or maintenance shall be the sole responsibility of the owner and shall not be supported by IMS
• Any damage to any non-agency Software is the owner's responsibility, and the owner will not be compensated in any manner for the damage
• Members shall provide original installation software to IMS for any non-agency Software installed on agency Computers, unless waived by IMS
• Software users are responsible for maintaining its security and location
• Software must be compatible with any already existing network programs
• Games are not to be installed or used on agency Computers
• Resident games shall be deactivated or deleted
• Movies, television shows, or other entertainment cannot be acquired on agency computer unless work related
• Software may not be downloaded from any source without authorization from the IMS Unit

Computer Security

• Security is divided into physical and logical security
• Physical security means unauthorized persons cannot physically use the computer/devices
• Logical security uses various mechanisms to block access to systems to unauthorized users, safeguarding against unauthorized attempts to access, alter, remove, disclose or destroy stored information
• When a work area, including an MDC, is to be left unattended, the user shall log-out or Password lock the terminal or workstation
• Members are responsible for the physical security of all assigned electronic devices
• Computers shall be configured to automatically Password lock within thirty (30) minutes of inactivity.
• Mandatory password requirements:
  • Minimum length of eight (8) characters on all systems
  • Not a dictionary word or proper name
  • Not be in combination of repeated characters
  • Not the same as the Username
  • Expire within a maximum of ninety (90) calendar days
  • Not be identical to the previous ten (10) passwords
  • Not be transmitted in clear text outside the secure location
  • Not be displayed when entered
• The use of names of children, pets, spouses, favorite team, favorite band, phone number, anniversary, etc. is discouraged
• Passwords and user identification names are not to be shared with anyone
• Supervisors who wish to investigate a subordinate's actions on any agency Computer should, after obtaining supervisory approval, contact the IMS Unit for access
• To prevent data corruption in network files and unauthorized users from accessing restricted files, Passwords shall not be written down or stored where others might see them
• Each member assigned a username is responsible for any actions performed under their log-in ID and Password Users shall not change or create administrative User Accounts or administrator Passwords on any agency Computer without approval from the IMS Unit
• Designated programs shall force periodic Password changes
• In the event of lock-out due to an expired Password, contact the IMS helpdesk or on-call IMS unit personnel
• Advanced Authentication (AA) shall be used with any computer used or located outside of a designated Physically Secure Location
• Methods of AA will be determined and configured by IMS
• Proximity badges and Cisco DUO are the sole solutions authorized by IMS for use in AA and physical security access to restricted locations; members must ensure AA solutions are operating appropriately and are not bypassed in any way during the login process
• Issues should be immediately reported to the IMS department via [email protected]
• Those found disabling, tampering or bypassing AA requirements may face disciplinary actions
• The Human Resources Unit Manager or designee shall, upon determination that a member will be leaving employment, suspended without pay, or is being reclassified to a different position, notify IMS, DAVID System Point of Contact, and the FCIC Terminal Agency Coordinator (TAC), in writing, and either immediately or prior to his/her separation date.
• Upon notification of a member's separation date, conduct a removal of unauthorized users from the systems within a twenty-four (24) hour timeframe; timeframe will commence on the first business day following that weekend or holiday, should notice arrive during that time.

Computer Use

• The agency Computer system and Hardware are for conducting agency business; similar to phone use, members may send/receive emails occasionally
• Any personal use of agency Computers, Hardware and/or agency Personal Communication Devices, whether on-duty or off-duty, or use of other Computers when acting as an agency representative is restricted, regulated, and monitored
• Personal use includes completing college course work, facilitating volunteer activities, and teaching at a law enforcement academy or other similar training
• Under no circumstances shall any member utilize, access, view, or transmit information from the National Crime Information Center (NCIC), Florida Crime Information Center (FCIC), DAVID/ELVIS, or other restricted network/database for personal use

Email and Instant Messaging

• Email Software includes Servers that process and store licenses, and the daily administration of usage
• Members who need to establish a new account should contact the IMS Helpdesk after ensuring it does not already exist
  • Request should include: Purpose, Requesting department or division, email address, who requires access IMS provide details of creation and access to newly created email accounts
• Each User Account has a fixed size mailbox that can contain a limited amount of data Agency users maintain accounts by reading emails, deleting transitory messages, professionally responding to emails, etc All emails and IMs are subject to FL Public Records Laws
• Each user is responsible for deleting items in their delete folder, deleting/filing items, and messages that do not need to be accessed
• Use of the "All Sheriff's" email distribution list or "Agency Wide" Instant Messages are restricted to the Office of the Sheriff, the Training Unit, Quality Assurance and Accreditation Unit, Human Resources, General Counsel, and IMS
• Users who need to send a message must seek approval from the Division Captain
• Agency users not accessing their email for more than one Business Day shall activate the "Automatic Replies (Out of Office)," which contain contact information of who to contact for assistance
• Personal use of agency email/IM should be kept to a minimum and should not interfere official duties, be for business outside commercial activities, go against written directives.

Public Record

• Email is considered a public record under Florida law and may be viewed by the public unless the context containing the information is completely exempt
• Information known to be CJI derived from NCIC/FCIC cannot be disseminated electronically
• Email/IM systems are the Sheriff's Office property and all sent messages are the Sheriff's property
• Email may be retrieved even when it has been erased (no confidentiality)
• The Sheriff reserves the right to audit email and IMs for messages that violate agency policy or law within the Sheriff's Office
• Members cannot retrieve or read email not sent to them unless approved
• Instant Messages should not be used to circumvent agency radio operation
• When driving, members are prohibited from responding to SMS
• Any message stemming from the Office, should contain "Confidentiality Notice"

Internet Use

• The agency provides internet activities for support, research, admin, and other agency business
• Internet access via the agency should not be used contrary to this policy
• The agency website should only be accessed by authorized IMS personnel
• Approved personnel may access the internet with authorized Wireless Access Point
• User shall perform regular maintenance of the agency assigned device, such as defragging drives, and deleting internet cookies and files
• All problems stemmed from maintenance should be directed to the IMS

Requesting Assistance

• Users should follow these procedures when requesting assistance
  • Spillman Records Management System/County Network = IMS helpdesk
• Problems/needs relating to modem lines, E-agent, FCIC/NCIC should be directed to the IMS Helpdesk
• Members of agency's website/intranet should contact the Public and Media Relations Section
• Technical- All requests shall be screened for compliance and compatibility with existing components, systems, and networks. All calls shall be directed to the IMS helpdesk Urgent requests after normal business should be directed to on-call IMS
• Urgent requests after normal business hours should be directed to the on-call IMS unit through Communications of equipment malfunctions, spillman inoperative status, and etc

MDC:

• All members should maintain the assigned computer
• Major members/Supervisors that are on leave for more than one (1) pay must return the assigned MD to the IMS, the supervisors will have to notify IMS of all deficiencies MDCs shall be repaired through agency directives
• IMS and MDC will require damage through chain of command
• Agreements will require authorization for use and should be safely stored- it can't be operated in motion
• Devices in motion will require assistance from the agency
• Heat devices should never affect the computer or mount

All members should contact IMS for the recommended suppliers:

• Members who want to work directly with the supplier should be responsible for maintenance of the equipment
• Privately purchased printers must be compatible
• K - Country has the rights to CAD/RMS and all agency requirements/ and any documentation for email