Computer Misuse

1. Computer Misuse Christina LaFountain Employee Relations Program Manager April 20, 2009

2. Video Clip

3. Governing Regulation and Notification to Employees • NASA policy directive, NPD 2540.1F provisions the limited use of Government office equipment, including information technology. • Explicitly identifies: • Inappropriate Personal Uses, specifically pornography • Privacy Expectations • Sanctions for Misuse • Annual Mandatory Information Technology Security Awareness Training • Center wide announcement dated February 2, 2009: Guidance on the Use of NASA Information Technology (IT) Systems and Office Equipment

4. Computer Misuse at GSFC • 9 Recent Cases: • 1 supervisor, 30 day suspension • 1 non-supervisor, 14 day suspension • 1 non-supervisor, 30 day suspension • 1 non-supervisor, removed for viewing child pornography Directed to OIG – to prosecute as criminal case • 5 cases currently under review • Since 2008 supervisors have counseled employees or issued written reprimands in approximately 18 cases for inappropriately downloading software, peer-to-peer file sharing, etc. Many of these cases resulted in malware infections. • Other computer misuse cases addressed include conducting outside business with work resources

5. Cost of Computer Misuse Loss of: • Productivity • Employee • Supervisor • Administrative staff including IT, Human Capital Management and Legal • Public trust/Embarrassment • Loss, destruction or alteration of information and information systems • Damage to IT systems from malware • Loss or interruption of network resources and/or connectivity

6. Identification of Pornography- Computer Cases • Observation • Supervisor • Other Employees-Hostile work environment • Review of Computer Activity • Child pornography-Directed to Inspector General • Other misuse-Referred to OHCM who works with supervisor

7. Guidance for Supervisors • Reality is that employees and contractors will misuse the computer. • By not acting, supervisors place the Center at risk and are permitting a hostile work environment to be created. Do not ignore the issue; address computer misuse as observed or detected. • Refer employee to Employee Assistance Program. If employee indicates that he/she has a “problem,” supervisors are still responsible for disciplinary action • Contact an Employee Relations Specialist to assist you in requesting data and preparing disciplinary action • Center is responsible for consistent action • Typically, first offense should result in suspension; however, this may vary depending on the facts of the case • Aggravating factors may include Criminal Acts such as child pornography, extensive viewing, time card fraud, employee’s position (supervisor, IT specialist)

8. Reference: Acceptable Use Activities you must avoid: • Do not violate Federal law, regulations, or policies • Do not tolerate racist, sexually explicit, or hate materials or harassment • Do not send chain letters, personal mass mailings, hoaxes, or harassing messages • Do not use unapproved Instant Messaging services or Peer-to-peer file sharing • Do not maintain/operate a personal business, including consulting or charities • Do not participate in partisan political activity, including fund raising, political endorsement, or lobbying • Do not attempt to circumvent security measures • Do not access IT resources for which you are not authorized • Do not exchange files for which you do not have the rights, e.g. piracy of movies/videos, software, music Reasonable useof email and the Internet for non-work related purposes is permitted assuming: • It does not interferewith your co-workers or your work • Must be brief • Must occur during non-work hours (lunch, after hours) • It does not incur additional expense to the Government