Osceola County Sheriff's Office: Computer use policy

• Osceola County Sheriff's Office policy and procedures are defined in document number 218.0, effective as of 12/05/22
• The policy intends to establish clear procedures for member use of computer systems, as per CFA 26.04 and 32.01

Policy Regulations

• The Osceola Sheriff’s Office regulates all computer hardware and software owned, purchased, grant-funded, donated, or leased that are used by agency members
• Regulations apply to the use of non-agency computers or personal communication devices while on duty or acting as an agency representative
• Members have no expectation of privacy when using agency computers, other computers, or personal communication devices in their agency representative roles.

Key Definitions

• Advanced Authentication (AA) provides extra security, like biometric systems, for user identification, login IDs, and passwords.
• Business Day is defined as Monday through Friday, excluding approved Sheriff’s Office holidays
• Chain Messages are broadly transmitted or forwarded emails that do not relate to official agency business
• Computer is a programmable electronic machine for storing, retrieving, and processing data, including laptops and personal communication devices
• Confidentiality Notice is an email addition stating the message is covered by F.S.S. 119, requiring the recipient to contact the sender and destroy the material if they are not the intended receiver
• County Information Technology Services (County IT) is responsible for network and internet access across all agency facilities
• Criminal Justice Information (CJI) from the FBI includes biometric data, identity history, and case/incident data.
• CJIS (Criminal Justice Information Services) are the federal requirements to protect the sources, transmission, storage, and generation of CJI
• Digital Certificate validates user access using encrypted data exchange to prevent unauthorized entry
• ELVIS refers to the Electronic License and Vehicle Information Database
• Email System permits the sending and receiving of electronic messages, and includes folders for storage/ a calendar
• External Memory Storage Devices include external hard drives/ USB flash drives for various data storage needs
• Florida Criminal Justice Network is a limited-access website operated by the Florida Department of Law Enforcement, offering resources and database access to criminal justice agencies
• Hardware includes all electronic components of a computer system, such as peripherals, circuit boards, and tablets
• Information Management Services (IMS) is responsible for hardware and software maintenance.
• Instant Message allows users to perpetuate conversations without delay
• Intranet, a local or restricted communications network created using World Wide Web Software.
• Logon, a unique identifier assigned to each User Account, indicating the name of the registered person
• MiFi Hotspot is a portable broadband device used by multiple end users
• Mobile Data Computer (MDC) is a commercial-grade mobile computer in law enforcement vehicles that can access system servers
• Password is a string of characters, alpha and/or numeric, needed along with a username to access a User Account.
• Personal Communication Device includes cell phones, pagers, e-mail devices, personal digital assistants, and “tablet” style computers
• Personally Identifiable Information (PII) is any data used to trace an individual's identity, like name, social security number, or biometric records
• Security safeguards physical or logical access to personnel, information, or assets of the agency
• Server(s) are high-capacity computers that store and retrieve data
• Software is a computer program, with instructions written in a specific language, for various operations
• Transitory Message is informal communication of short-term value, such as reminders about scheduled meetings
• User Account is an account for agency personnel to securely access systems, requiring a username and password
• Website is any computerized document, file, or menu accessible online e.g. the Internet
• Wireless Access Point (WAP) allows wireless devices to connect to a wired network using Wi-Fi or Bluetooth.

Proper Access and Usage

• All access to and/or use of any agency computer, server, or personal device must follow FSS 817.568
• Improper use or unauthorized access to agency computers, digital certificates, systems, or networks may lead to discipline
• Improper use includes commercial activities, offensive content, gaming, copyright violations, privacy violations, vandalism, or misuse of email systems
• All hardware and software must comply with copyright laws and manufacturer guidelines

Hardware Guidelines

• Only agency approved hardware should be used

Computer Terminal Sharing

• Ensure the use of own username and password

Non-Agency Hardware

• Members wishing to use hardware must request permission
• Need recommendation from IMS and Division Captain approval
• User responsible for support, maintenance, and damage

Unbudgeted Requests

• Must go through chain of command
• Must provide IMS with a copy

Installing, Opening, and Modifying

• Only to be done by the IMS Unit

Loss or Theft Reporting

• Any loss should be immediately reported to IMS
• A full accident report must be completed and is subject to administrative review

Communication Devices

• Include air cards, MiFi hotspots, body cams, cellular devices, and mobile data computers

External Memory Storage Device protocols

• Requires approval and email from IMS supervisor
• Must be periodically scanned for viruses
• Must be encrypted
• Any loss or theft must be immediately reported

Software Guidelines

• Only agency approved software allowed

• Request permission from Section Lieutenant/Manager for use of non-agency software

• Requires recommendation from IMS and Division Captain approval

• User responsible for maintenance and damage

• Providing Original Software Info

• Provide to IMS for Non-Agency Software Installed

Software Compatibility

• Must be compatible with existing programs
• Must not reduce the productivity of the record management systems

Games and Entertainment

• They are not to be installed

Installation Source

• The IMS unit must authorize the source

Security Measures

• Divided into physical and logical security
• Maintain physical security so they can't be physically used by unauthorized people
• Maintain logical security to block unauthorized access

Unattended Computer Protocols

• Log out or password lock the terminal or workstation

Member Responsibility

• Maintain Physical Security of all assigned devices configured to auto password lock

Password Guidelines

• Min. 8 Characters
• Not a dictionary word
• Not in combination of repeated characters
• Not the same as the User name
• Expire after 90 days
• Not the previous 10 passwords
• Not transmitted in clear text
• Not displayed when entered
• Discouraged use of personal information

Password Security

• Never share passwords
• Contact IMS unit for assistance
• Do not write passwords down
• Responsible for your own password login
• Do not create administrative accounts without approval

More Password Protocols

• Designated programs shall force periodic password changes
• Contact IMS for assistance
• Advanced Authentication (AA) to be used with computers located outside of secure location
• Proximity badges and Cisco DUO are approved by IMS for use in AA

AA Requirements

• Members must ensure proper AA solutions
• Report issues to IMS department
• Members must not disable AA requirements, and are subject to discipline

HR Protocols

• HR must be kept in the loop of employee changes
• Notify IMS, DAVID system point of contact, and FCIC Terminal Agency Coordinator (TAC)
• All parties must remove the employee from the system within 24 hours

Computer and Hardware usage

• Should be for agency business
• Similar to phone use, members may access for personal reasons

Restricted Device Use

• Any use is restricted, watched, and regulated
• May include college work, volunteer activities, and law enforcement training

Don't share info from external source

• Must not transfer any information from the NCIC or FCIC

Email and Instant Message regulations

• The software includes servers and daily monitoring of each account
• Establish an email after contact with the IMS helpdesk
• Requests should include purpose, department, and info

User Account Protocols

• Fixed size mailbox
• Delete transitory messages
• File maintained messages
• Responsibility of purging all deleted folders

Restricted Contact List

• All Sheriff Email List, use the "All Sheriff's" email distribution list
• Receive approval from the Division Captain or civilian equivalent

"Out of Office" Rules

• If away for More than Business Day
• Located under the "File" tab of outlook

Personal Communication Regulations

• Minimum use of the agency email
• Must not interfere with officer duties
• Must be infrequent

Email and Instant Message Laws

• Considered public record
• Can be viewed unless there is any exemption
• Excludes transmissions approved by the IMS
• Email system is the property of the sheriffs department

Assumed Confidentiality

• There is none
• Even after deleting, the message can still be retrieved and read
• Sheriff has the right to review and disclose messages within the email system

Unauthorized contact protocols

• Unauthorized to retrieve any emails without the contact of the supervisor
• Instant messages shall not circumvent radio communications
• No messaging while the vehicle is moving

Digital Business Card Protocol

• Utilize green and white Sheriff's department business card at the footer of the email
• All emails must obtain a Confidentiality Notice

Internet Use

• Provided by the agency for research, administrative processes, community service, and agency business
• Should not interfere with policy
• Websites must be authorized members to alter them

Wireless Access

• Approved personnel have access to an agency maintained WAP

Wireless Access Protocols

• Personnel using this access point must agree with all IMS guidelines
• Violation leads to being blocked

User Maintenance

• Members perform procedures for their assigned computers
• Those unsure need to contact IMS

Spillman and County Network

• Directed to the IMS HelpDesk

Communication

• Problems or needs relating to modem lines, E-agent, FCIC/NCIC, or CJNET should be directed to the IMS Helpdesk.

Web Page and Intranet Protocol

• Members must contact the Public and Media Relations Section

User assistance protocol

• Direct all problems to the IMS service desk
• Notification by automatic messaging

After Hours Requests

• Contact on-call IMS personnel via communication

Mobile Data Computer (MDC) protocol

• The officer is responsible for use
• Supervisors must return equipment of subordinate
• Repair and maintain promptly
• Use MDC only in alignment with guidelines

Safety Protocols

• Must be operated safely
• Never operate while in motion

Security Guideline

• Safeguard the info and lock the screen

Protocol for when not in service

• MDC Should be removed from the mount
• MDCS shall not be defaced

Printer protocols

• Contact IMS unit for a list of recommended printers
• MDC Owners are responsible for printer costs
• Secure the damage
• Must follow driver installation protocol

CAD and RMS Protocols

• IT has overall agency responsibility
• IT has logical network perimeter security
• IMS has overall responsibility for agency system backups, contact list, email, and document management Software.

Additional Server Protocols

• Sherriff or designee may need to create servers
• Servers must store records and database info
• All data's and databases are backed up regularly and securely

Data Storage Protocol

• All hard copies retained are subject to policy