Enforcing Acceptable Use Policies

Written by Kim Fitzer, Hinsdale Central High School, Hinsdale, Illinois
Original written by Jim Peterson, Bloomington School District, Bloomington, IL

Because so many school districts across the country have adopted Acceptable Use Policies, the utilization and development of these policies now seem to be somewhat standard. Much has been written on the purpose and writing of a good Acceptable Use Policy, so this paper will not dwell on these topics. However, several key issues have arisen in conjunction with the adoption of Acceptable Use Policies in recent months, and it may be important to investigate the ramifications of these issues. This paper will primarily focus on the enforcement of acceptable use policies, and additional considerations which may have to be made by school technology administrators and staff.

• If an AUP states that all users' activities will be monitored, then the school IT staff needs to be sure that it is doing just that. The school server should maintain an "Internet log" or history of all sites visited by users. Furthermore, this log should be reviewed daily, to determine if unacceptable activity has taken place and where. If users are aware from the beginning that their goings and comings on the Internet will be observed, and that noncompliance will result in their being barred from the use of the system, inevitably fewer problems will arise (1).

• If the school employs the use of filters to block unacceptable content, there needs to be an understanding that filters cannot possibly block all questionable content, and may block material that is useful to staff and students. Where filters fail, a very well-written AUP can take over. The AUP should be very clear on what kinds of content is considered unacceptable, whether it be chat rooms, news groups, pornography, sites that promote hate or violence, term paper vending machine sites, gaming, or any other questionable material. By avoiding generalities and vague language in the drafting of the AUP, districts can minimize their liabilities in the even that the filters fail (2).

• In order to be sure that students, staff and parents understand the provisions within and consequences of violating the AUP, merely requiring the users signature may not be enough. Explaining the AUP to students in an open discussion forum, holding staff inservices on the provisions of the AUP and how to effectively use the Internet, making recommendations for meaningful assignments that use the Internet, restructuring computer labs so that all computers are visible from a single location, and involving parents in their child's computer usage are all steps that a school can take to ensure compliance with their AUP (3).

• Further monitoring of the school's network, especially in schools with extremely heavy technology use, may require the use of software that only activates when violations have occurred within the system. Products such as eSniff and VIEW passively sit on the school's server and do not activate until the linguistic and analyzing technology detects inappropriate use. Without the user's knowledge, the software then alerts the proper authorities and auto-saves the offending document for the administrator to view to determine if an infraction has occurred. The software also logs the time and IP address of the computer used. While this seems like a violation of privacy, one of the main features of an AUP is to notify users that they essentially have no right to privacy if they use an institution's system (4). Further, the use of a product such as this allows a greater freedom in the use of the Internet for educators and students, while only limiting unacceptable use. Filtering software is not needed (5).

As stated before, the enforcement of an AUP really requires strong support from everyone in the educational community: administrators, teachers, support staff, parents, and of course, students. If an AUP exists only as a document and not an inviolable entity within the culture of the school, transgressions will occur. Further, steps taken prior to the need to enforce the AUP is perhaps the best approach. Several precautions can be taken to ensure that the AUP is followed:

• Use clear and precise language: A well-written document will eliminate confusion and minimize liabilities for students, staff and administrators. Be sure to carefully list all circumstances in which a violation may occur and avoid generalities.

• Frequently review and revise the AUP. Make sure that all technology bases are covered, and eliminate any legalese that may seem deliberately confusing to the average reader (6). It may also help to consult all parties in the community to find out where the areas of concern are, and address them in the AUP. For instance, if a teacher feels that students should not be playing games, even in their free time in her computer lab, but other teachers do allow it, then a consensus needs to be reached regarding games and stated so in the AUP.

• Make sure that the AUP is school board approved for the entire district. Legal implications (which will be discussed later ) as well as conflicting information may arise if the school board has no knowledge of or has not voted on the provisions within the policy, especially if every school in the district drafts their own. Once again, clear and precise stipulations for accountability, consequences, what constitutes improper and proper use, liability limitations, codes of conduct, and establishment of a review and audit process should be spelled out carefully and agreed upon by the school board, in the event violations do occur (7).

Because violations of a school's AUP can and do occur, even with the most ironclad of documents, schools need to be aware of the potential legal ramifications that may arise should a student or staff member be reprimanded for a transgression. Several cases have developed which illustrate the need for extensive research prior to drafting an AUP, so that the legal pitfalls may be avoided.

• In a lawsuit filed by a member of the community and parent of a student, Exeter Regional Cooperative School District's AUP was called into question when it was discovered that the Internet logs the district's servers regularly recorded were not being monitored. Furthermore, when the logs were requested by the community member for perusal, the district refused and called on their own right to privacy. Courts take a dim view of this claim, particularly when the Internet logs are intended to monitor Internet use, which is itself not subject to invasion of privacy guarantees. If the district is monitoring Internet use, there can be no claim for an invasion of privacy, by any parties involved (8).
• As the AUP is written for and protects the school community, the school community also needs to be aware of how the AUP applies to them. Some members of the community, such as parents and school board members may think that an AUP does not apply to them because they are not direct users of the school's system. However, an AUP should cover all electronic communication, and in particular the wording of that communication. Failing to regard "netiquette" when sending emails can subject the author to libel at the worst, and an embarrassing situation at the least. Many states have enacted "sunshine laws" requiring that when two or more school board members gather, an actual meeting is taking place and therefore subject to public disclosure. Using e-mail to voice opinions and views about faculty, administration, other board members, parents, students or board policies may be a violation of the sunshine laws, or may open the school board to litigation by the offended party (9). And some schools have taken steps to minimize teacher harassment by parents through e-mail by adding a parental code of conduct to their AUP (10). While there are currently no lawsuits regarding inflammatory and defamatory language from parents pending, the potential may exist in some areas.

How can I be sure that my school's AUP is enforceable?

Review the school's AUP and use the above guidelines as a reference. If the AUP seems to contain vague language, or is written in legalese, or seems to be too general in terms of what it will and won't permit, the AUP may need to revised. Also, it may be helpful to take the AUP to a member of the Language Arts Department (if that is not your subject area), and have the document scanned for improper wording, misspelling, or other potential problems (11). Remember, if it is not clear to you, a highly-educated individual, then it will not be clear to your students.

What should I do if one of my students has violated the district's AUP?

First, make sure that a violation has occurred. If your district does not employ tracking or "smart" technology, then it may be that your district has passed the accountability reins to you. Be aware of what content areas and transgressions constitute a violation, and then compare what the student has done with those provisions. If a violation has occurred, then the issue should be taken directly to the dean of students, or any other disciplinary team in the building. At this point it is out of your hands. The absolute worst action would be to take no action at all. This conveys several negative messages to your students:

1) That the AUP is essentially worthless, and that computer use violations are acceptable in your classroom.

2) That your authority can be challenged. As any teacher knows, one of the keys to a good classroom management plan is maintaining a position of authority when classroom or school rules have been violated.

(1) November 1, 2000. David A. Splitt. Ethics and Law -- "Acceptable-use policies are useless unless strictly enforced." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=1764

(2) July 1, 2001. David A. Splitt. "Back up your filtering with an airtight AUP." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=2755

(3) January 1, 2001. "Five Keys to Supporting an Acceptable Use Policy."
abstracted from "Setting Standards for Acceptable Use" by Jerry Crystal, Cherie A. Geide, and Judy Salpeter Technology & Learning, November 2000, p. 24. Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=2150

(4) November 1, 2000. David A. Splitt. Ethics and Law -- "Acceptable-use policies are useless unless strictly enforced." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=1764

(5) 2002. Vericept Corporation. "Content monitoring, blocking and filtering: a comparison." http://www.vericept.com/solutions/education_monitor.shtml

(6) November 1, 2001. David A. Splitt. "Give your AUP a fall tune-up--here's how." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=3135

(7) October 1, 2001. David A. Splitt. "Understanding the ‘P’ in AUP." Published online in eSchool News Online
http://www.eschoolnews.org/news/showStory.cfm?ArticleID=3055

(8) November 1, 2000. David A. Splitt. Ethics and Law -- "Acceptable-use policies are useless unless strictly enforced." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=1764

(9) 2002. Kathleen Vail. "The Perils of E-mail." Published online in the American School Board Journal. Cover Story, September 2002. http://www.asbj.com/current/coverstory2.html

(10) September 5, 2000. Cara Branigan. "Fear of flaming leads school to issue eMail code of conduct to parents." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=1324

(11) November 1, 2001. David A. Splitt. "Give your AUP a fall tune-up--here's how." Published online in eSchool News Online. http://www.eschoolnews.org/news/showStory.cfm?ArticleID=3135

"Sunshine laws." Published online in the First Amendment Handbook by Reporters Committee for Freedom of the Press. Chapter 9, Sec. 3 http://www.rcfp.org/handbook/viewpage.cgi?0903