Osceola County Sheriff Computer Policy

• The document outlines the Osceola County Sheriff's Office policies and procedures regarding agency computers
• Sheriff Marcos R. Lopez is in charge
• The document's number is 218.0
• The effective date is 12/05/22
• The last P.R.C. Review was 08/20/13
• The policy rescinds document from 01/09/20
• The accreditation standards are CFA 19.02, 26.04, 32.01

Purpose of policy

• Establishes procedures for member use of computer systems

Policy Regulations

• Applies to Computer Hardware and Software owned, purchased, grant-funded, donated, or leased by the Osceola County Sheriff's Office or the Osceola County Board of Commissioners
• It extends to any non-agency Computer, or Personal Communication Device while on-duty or while acting as an agency representative
• Members lack privacy expectations on agency computers/devices while acting as an agency representative

Definitions

• Advanced Authentication (AA): Enhances security beyond login ID and password via biometrics, cards, etc
• Business Day: Monday through Friday, excluding Sheriff’s Office holidays
• Chain Messages: Broadly transmitted/forwarded emails unrelated to official agency business
• Computer: A programmable electronic machine for data storage, retrieval, and processing
• Confidentiality Notice: Email disclaimer indicating F.S.S. 119 coverage and recipient instructions
• County Information Technology Services (County IT): Osceola County department for network and internet access
• Criminal Justice Information (CJI): FBI-provided data including biometric data, identity history, and case details
• CJIS (Criminal Justice Information Services): Federal security mandates for CJI protection
• Digital Certificate: A computer file validating user access using encrypted data
• ELVIS: Electronic License and Vehicle Information Database
• Email System: Permits electronic correspondence with folders and scheduling
• External Memory Storage Devices: Devices for data storage like external hard drives and USB flash drives
• Florida Criminal Justice Network: Limited-access website by the Florida Department of Law Enforcement
• Hardware: Electronic components of a computer system, including peripherals and devices

Definitions continued

• Information Management Services (IMS): Osceola County Sheriff’s Office unit for hardware & software
• Instant Message: Electronic system for real-time written conversations
• Intranet: A local, restricted communications network using World Wide Web Software
• Logon: Unique identifier assigned to a User Account, often the person's name
• MiFi Hotspot: Portable broadband device for sharing 4G or 5G internet connections
• Mobile Data Computer (MDC): Commercial grade mobile computers in law enforcement vehicles or other such computers capable of accessing system servers
• Password: A string of alpha/numeric characters required for User Account access
• Personal Communication Device: Cell phones, pagers, personal e-mail devices, personal digital assistants, smart phones, and “tablet” style Computers

Definitions continued

• Personally Identifiable Information (PII): Data to identify an individual, like name or SSN
• Security: System to protect physical/logical access to personnel, information, or assets
• Server(s): High-capacity Computer that stores and retrieves data
• Software: Computer program with instructions for operations, supplied by the user
• Transitory Message: Informal communication of short-term value, like reminders
• User Account: Account for agency personnel to securely access systems
• Website: Computerized document or file on the Internet, Intranet, or World Wide Web
• Wireless Access Point (WAP): Device allowing wireless connection to a wired network

Procedures Regarding Access and Use

• Computer uses must comply with FSS 817.568
• Improper or unauthorized use can lead to discipline, including termination involving:
  • Commercial activities
  • Offensive content
  • Game playing
  • Copyright violations
  • Watching media for entertainment - Releasing CJI to unauthorized persons

Hardware and Software Procedures

• Agency-approved Hardware/Software must comply with copyright laws
• Sharing computer terminals require logging in with individual credentials
• Using non-agency Hardware needs chain of command approval
• IMS doesn't support or compensate for damage to non-agency Hardware
• Unbudgeted Hardware needs inter-office memo and IMS Director notification
• IMS Unit approval needed for hardware installation, opening, modification, repair, or moving
• Report loss/theft of agency communication devices to IMS
• Communication devices issued by IMS include air cards, MiFi hotspots, and cellular devices

External Memory Storage Device Procedures

• Using external memory storage devices from non-Sheriff's Office sources needs IMS approval via email
• These devices must be periodically scanned for viruses
• Devices need to meet IMS equipment standards and use pre-installed encryption software
• Report lost/stolen storage devices to IMS ASAP
• Members are responsible for maintaining software's security and location
• Software must be compatible with existing systems
• Games, unless work related are prohibited on agency Computers
• Software downloads need IMS Unit authorization

Security Protocols

• Physical security prevents unauthorized computer use
• Logical security blocks unauthorized system access
• Log out/Password lock unattended workstations
• Members secure assigned electronic devices
• Computers must auto-lock after 30 minutes of inactivity

Passwords

• Passwords need to be complex which include:
  • Minimum of 8 characters
  • Not a dictionary word
  • Expire within 90 days
• Discourages names of children, pets, or phone numbers
• Passwords and IDs cannot be shared
• Supervisors need approval and IMS Unit contact for subordinate investigations
• Passwords shouldn't be written down
• Assigned members are accountable for actions under their credentials
• Users can't change administrative accounts or administrator passcodes, unless they have approval from the IMS Unit

Advanced Authentication (AA)

• It is required for computers outside secure locations and configured by IMS
• Proximity badges and Cisco DUO are authorized for AA and physical security
• Report AA issues to [email protected]
• Disabling AA leads to disciplinary action
• HR notifies IMS, DAVID System Point, and FCIC Terminal Agency Coordinator upon member separation
• Functions must remove unauthorized member access within 24 hours or on the next business day

Computer Usage Protocols

• Agency computers are for official business only
• Limited personal use is allowed, like phone use however, misuse may harm the agency's repuation
• Transmitting NCIC/FCIC data for non-law enforcement reasons is prohibited
• Software includes servers that process and store emails and licenses
• The IMS Helpdesk can help with new email accounts but a request is required

Requests

• New Email requests include:
  • Purpose
  • Requesting department
  • Name of email account
  • Access requirements
  • IMS provides creation details
• User accounts have data limits, and emails are subject to Florida public records laws
• Users purge deleted items and archive infrequently accessed messages

Communication Protocols

• "All Sheriff’s" email lists are restricted, approval is needed from Division Captain or equivalent
• Activate auto-replies with user status and contact information when out
• Personal use of email/IM should be minimal
• Use must not interfere with official duties
• All electronic messages are public record
• Distributing CJI electronically is prohibited
• All message systems and emails is Sheriff's Office property
• Confidentiality isn't guaranteed even with deleted messages
• Sheriff can review all messages
• Members require supervisor approval to read others' emails
• Instant messages cannot circumvent radio operations
• No responding to text when vehicle is in motion
• Email digital business cards should be standard
• All emails should have a "Confidentiality Notice" defined by the Sheriff’s Office Director

Internet Usage Details

• Authorized for research and agency business only
• Policy violations for internet use can result blocked by IMS
• Maintenance includes recycle bin, cookies, and defragging; contact IMS for assistance
• Requesting assistance should follow procedures for: -Spillman system issues -Communications -Website/intranet contributions -Technical issues- All requests are screened
• After-hours requires include contacting on-call IMS for: -Facility issues, Spillman, or Password problems -Lost badges/devices

Mobile Data Computer (MDC) Protocols

• Members are accountable for proper MDC use and maintenance
• Supervisors retrieve MDC from members on leave and notify IMS as necessary
• Prompt MDC repairs per directives, complete Accident/Loss Report for significant damage
• Only authorized purposes are allowed using MDC with written directives and agreements
• MDCs must be used safely and securely
• Secure MDCs when not in use to guard information; store in secure location
• Can't be defaced
• Contact IMS about printers