On Sunday 08 June 2008 14:46:18 Kathy Bergsma wrote:
> This is not a new policy, but it's a new procedure to enforce a
> longstanding copyright policy.  The copyright take-down notifications
> last month were 10 times the normal amount.  The volume increase
> indicates that a more proactive approach is needed.  That's why we
> started the notifications, but only for the most popular p2p clients.  We
> understand that there might be legitimate use and there might be false
> positives.  We'll be glad to make exceptions to stop further
> notifications.

Your former policy was to assume innocence until you got an accusation of 
guilt (a DMCA complaint). Your new policy is to assume guilt until 
innocence is proved. That is most definitely a change in policy.

You _say_ you understand that there may be legitimate use, but your 
procedures do not adequately provide for the existence of legitimate users, 
and in fact seem to assume that the activity is illegal.

For instance, these are being sent as security incident tickets, even though 
there is only the suspicion of an incident. Policy requires that these 
tickets be contained the same day, but finding and talking to a user often 
takes longer (graduate students in particular keep strange hours).  All we 
can do to contain those "incidents" is _assume_ guilt and disconnect the 
network port until we hear from the user of the system, so we may be 
interrupting perfectly legitimate research activity because of policy.

>
> We did not anticipate that anyone would expect these notifications to
> result in fines, expulsion or deportment.  It shouldn't even result in a
> mar on one's record.  Our experience is that a reasonably honest person
> will stop bad behavior with verbal counseling.

I, and several people I've talked to, find this statement to be a bit odd. 
The instructions sent with many of the P2P tickets specifically say that if 
the activity was illegal, then:

"... inform the user's supervisor if staff, or Student Judicial Affairs if a 
student."

That means initiate the disciplinary process for illegal activity. That is a 
firing offense. I know many supervisors would just give a verbal warning on 
the first offense, but others would go by the book and get HR involved. 
Once HR is involved, there is going to be, at the very least, a mar on 
their record, if they aren't fired outright. And last I heard (which was a 
few years ago), referral to SJA also resulted in at least a notation on 
their (unpublished) record.

If you are going to proactively seek out P2P violations, perhaps UF needs a 
published policy on the discipline process for these violations. Does the 
first offense result in only a verbal warning? Or do you get fired? Right 
now, it can go either way, depending on the supervisor.

>
> We will revisit our notifications procedures.  Maybe we should drop
> investigation part of our notification and just ask the IT contact to
> refer the notification directly to the supervisor.  The supervisor can
> simply ask the user and, in most cases, an IT investigation will not be
> needed.  Does this help?

I think it would help to simply say "Investigate and ensure that the 
activity is for legitimate purposes."  For one thing, that maintains the 
presumption of innocence instead of assuming guilt.

Also, I don't think these should be handled through the normal security 
incident ticketing system (or perhaps there should be a category of ticket 
that doesn't demand one-day response), and they certainly shouldn't be 
marked as DMCA complaints when there has been no complaint.

Another problem is that it appears these tickets are being generated 
manually, which can result in long delays between the observed activity and 
the issued ticket, and in some cases, duplicate tickets for the same 
activity. We had one instance in which a duplicate ticket (different ticket 
number) was issued AFTER the activity had been contained, which resulted in 
significant confusion until we finally realized that the new ticket was 
reporting activity that had occurred 18 hours earlier.

- Bob



>
> Kathy
>
> Kisida, Todd wrote:
> > We received our first one today.  It was for legitimate use
> > (downloading a Linux ISO) and in this case it was easy to find the
> > user/computer. All in all *this* one was easy to deal with, but it was
> > special case.  I see many problems with this overall.
> >
> > According to the email, we're supposed to determine if the use of p2p
> > is legitimate or not but we're not supposed to take any action if it's
> > not. If they are downloading illegally and we ask them about it,
> > doesn't that tip the user off and possibly change their behavior?   If
> > so is that a good thing or a bad thing?
> >
> > How I'm supposed to determine if the use is legitimate or not?  Linux
> > ISO's and TV shows are clear, but what about the cases that aren't
> > clear?
> >
> > Say I've got a user sharing a Linux ISO or something for a long period
> > of time.  I'm I going to get a daily incident report?  Do I have to
> > check each time for what content is being shared? If not, what if the
> > user  decides to start sharing a TV show and I didn't follow up on each
> > report?
> >
> > While our IP addresses tend to be pretty static, they are DHCP.  Seems
> > like we'll have to check every report because an IP could have changed.
> >
> >
> >
> > -----Original Message-----
> > From: Campus Computer Coordinators [mailto:[log in to unmask]] On Behalf
> > Of Brent A Nelson
> > Sent: Friday, June 06, 2008 4:29 PM
> > To: [log in to unmask]
> > Subject: The great peer-to-peer hunt
> >
> > I am a bit surprised that I haven't seen any discussion about the new
> > policy to track down and investigate peer-to-peer activity, apart from
> > the
> > CNS announcement that they were planning to send out notices.  Well,
> > we've
> > already been notified by CNS that several users in our department have
> > been detected using peer-to-peer software.  This is the text of the
> >
> > notice:
> >> Peer-to-peer traffic was detected from IP address(es) below. Although
> >> some uses of peer-to-peer applications are legitimate, many are used
> >
> > for
> >
> >> obtaining illegal copies of music, movies, games and software.  Please
> >> investigate to identify the user responsible and determine if their
> >> use
> >>
> >> was legitimate.  If not, inform the user's supervisor if staff, or
> >> Student Judicial Affairs if a student.  Do not attempt to take action
> >> against the user yourself unless you're the user's supervisor.
> >>
> >> For more information about UF's position on copyright violations see:
> >> http://infosec.ufl.edu/copyright
> >
> > How are other departments planning on handling this? I'm really not
> > looking forward to getting staff fired (one way to handle budget cuts,
> > I
> >
> > suppose) and students expelled/deported/fined more money than they will
> > ever make. Has everyone already warned all the people in their
> > department?
> >
> > Are we really going to demand that people turn over their personal
> > laptops
> > for study/evidence gathering? Do we need to hire more personnel to
> > conduct
> > such investigations? Is this really our job?
> >
> > If peer-to-peer is allowed for its legitimate uses, but it requires an
> > investigation for each and every user, doesn't that practically
> > prohibit
> >
> > its use? Perhaps it would be better to just filter it by default and
> > allow
> > it only for specific people who claim their use is legitimate?
> >
> > Something doesn't feel right about this...
> >
> > Thanks,
> >
> > Brent Nelson
> > Director of Computing & Copyright Policeman (now, more than ever)
> > UF Physics
> >
> > PS Cans of worms should come with warning labels saying, "Do not open."