The University of Western Australia – Information Services Committee

Procedures for Exercising “Take Down” Powers

Adopted by the ISC on 3-Dec-03.

There are occasions when it becomes necessary to consider disconnecting a computer or sub-net from the University’s Network or cause “content” to be removed (eg from a Website).  Such situations may arise  in a variety of circumstances.  For the purposes of these Procedures, these have been grouped into 3 broad categories, as follows

Categories of Circumstance where Take Down Procedures must be Exercised:

1. Unquestioned action must be taken:

1. The Australian Broadcasting Agency (ABA) or the Australian Federal or WA State Police acting with appropriate authority require content to be removed from a computer system connected to the University Network.

2. Allegations are made which require some investigation:

2. An external agency or individual asserts that a computer system connected to the University Network contains material which is illegal or contravenes their Copyright or that of someone they represent;
3. A computer system connected to the University Network is found to contain (and make available to other computer systems within and/or outside the University Network) material which is offensive or illegal.

3. Potential danger to the University’s computing or networking facilities:

4. A computer system connected to the University Network has been compromised or hacked and is being used to launch DDoS attacks or other malicious activity;
5. A computer system connected to the University Network is generating inordinate volumes of traffic which is “clogging” the network.

Allegations of type (b) are usually accompanied by a demand that the material be removed or the system disconnected from the network within a stated period of time, eg 48 hours, failing which legal proceedings will be initiated.

It must be noted that the above is not intended to be a definitive list of all circumstances in which the Procedures below should be followed.  Rather they constitute a guide, and other situations not covered directly here must be dealt with along similar lines, and in the “spirit” of these Procedures and Guiding Principles.

Note also that allegations or demands along any of the above lines could be made to any one (or more) of a number of different UWA officials, including:

• the Vice-Chancellor;
• other senior officials, such as Registrar;
• Legal Services Office;
• University Librarian;
• IT Policy Executive Officer;
• Director of ACS/UCS;
• UCS Manager
• Various Deans, IT Managers and others in positions of authority.

Allegations or demands may actually be made to almost any individual member of the University, and it is important that basically the same Procedures be followed in every case.

In the following, “Local ITSO” means the IT Support Officer responsible for providing IT support for the computer or sub-net in question.  The “Owner” of a computer system is that person normally responsible for it.

Guiding Principles:

The Procedures below are expressed in the light of the following Guiding Principles:

             i.        The University will comply with properly authorised formal “Take Down” orders (eg from the ABA) without question;

           ii.        The matter is to be handled by the relevant Local ITSO if possible;

          iii.        UCS is to handle it otherwise;

         iv.        The actions that UCS or the Local ITSO are to take are in most cases prescribed;  judgement will normally be required only for cases (d) and (e);

           v.        The Owner is to be reached first, if possible (and if not precluded by the nature of the “incident”);

         vi.        The “safety first” principle applies – take down or bar if the Owner can’t be reached;  seek proper advice subsequently;

        vii.        The Procedures set out escalation procedures to be invoked as appropriate;

      viii.        The Legal Services Office is to be the arbiter in cases of doubt, with the Registrar responsible for resolving any dispute.

In the Procedures set out below, various communications take place.  These may be conducted by email (for preference) or by phone where necessary, the latter being backed up by email where possible.  All such correspondence must be preserved for an appropriate period of time.

Procedures:

The normal procedures for dealing with situations requiring some form of Take Down (as described above) are as set out below.  Where any of the actions below is challenged by any individual or unit, then the matter will be referred to the Registrar for resolution.

1. Unquestioned action must be taken:

a.       If the Owner or Local ITSO cannot be identified or if the location of the offending computer is not already known, the matter will be referred to the Manager of UCS for initial action, as below;

b.      If UCS is itself not responsible for the computer system in question, then it will contact the Local ITSO responsible for the sub-net containing that computer system;  if no Local ITSO exists (or is known), the head of that section (eg School Manager or School Head) will be contacted instead and henceforth treated the same as the Local ITSO for the purposes of the following;  if UCS is responsible for the system in question, or if the Local ITSO and section head cannot be contacted, then UCS will follow the steps below acting as the “Local ITSO”, advising the Local ITSO by email or voicemail immediately following this action;

c.       The Local ITSO will identify the sub-net, location and Owner of the computer system or content in question;

d.      The Local ITSO will request that the Owner of the computer system or offending electronic material in question take the necessary corrective action, remove the offending material, and/or disconnect or disable the computer system from the University Network;

e.       If the Owner cannot be reached, or if the Owner refuses to take the necessary action, then the Local ITSO will disconnect the computer system from the University Network or remove the offending material in question as appropriate, advising the Owner immediately following the action;

f.        The Legal Services Office and relevant head of section will then be advised of the action taken.

2. Allegations are made which require some investigation:

a.       If the Owner or Local ITSO cannot be identified or if the location of the offending computer is not already known, the matter will be referred to the Manager of UCS for initial action, as below;

b.      If UCS itself is not responsible for the computer system in question, then it will contact the Local ITSO responsible for the sub-net containing that computer system;  if no Local ITSO exists (or is known or can be contacted), the head of that section (eg School Manager or School Head) will be contacted instead and henceforth treated the same as the Local ITSO for the purposes of the following;  if UCS is responsible for the system in question, or if the Local ITSO and section head cannot be contacted in a reasonable time, then UCS will follow the steps below acting as the “Local ITSO”, advising the Local ITSO by email or voicemail immediately following this action;

c.       The Local ITSO will identify the sub-net, location and Owner of the computer system or content in question;

d.      The Local ITSO will request the Owner of the computer system or offending electronic material in question to take the necessary corrective action, remove the offending material, and/or disconnect the computer system from the University Network;

e.       If the Owner cannot be reached in a reasonable time, then the Local ITSO will disconnect the computer system from the University Network or remove the offending material in question as appropriate, pending further investigation*, advising the Owner or Local ITSO by email or voicemail immediately following this action;

f.        If the Owner or the Local ITSO refuses to take the necessary action (eg because they claim that their material is non-infringing) in a reasonable time, then the Legal Services Office will be contacted to make a judgement as to whether to force compliance with the demand (at least for the time being) in order to avert the threatened legal action, or to ignore the warning on the basis that the demand is insufficiently validated (note that it is possible for a malicious person to make false assertions/demands for the sake of the disruptive effect they have, and there may actually be a legal obligation in some cases that material not be taken down);

g.       * Where unilateral action “pending further investigation” has been taken above, then the Legal Services Office will take responsibility for pursuing the matter, with the technical assistance (where necessary) of UCS or the Local ITSO as appropriate;  the Legal Services Office is the designated body that will make any necessary judgements (such as required in (f)) in pursuit of the case, and that will advise UCS or the Local ITSO to disconnect or reinstate a computer system if it deems it appropriate;

h.       The Legal Services Office and relevant head of section will be advised of the action taken.

3. Potential danger to the University’s computing or networking facilities:

a.       If the Owner or Local ITSO cannot be identified or if the location of the offending computer is not already known, refer the matter to the Manager of UCS for initial action, as below;

b.      If UCS itself is not responsible for the computer system in question, then it will contact the Local ITSO responsible for the sub-net containing that computer system;  if no Local ITSO exists (or is known), the head of that section (eg School Manager or School Head) will be contacted instead and henceforth treated the same as the Local ITSO for the purposes of the following;  if UCS is responsible for the system in question, or if the Local ITSO and section head cannot be contacted in a reasonable time, then UCS will follow the steps below acting as the “Local ITSO”, advising the Local ITSO by email or voicemail immediately following this action;

c.       The Local ITSO will identify the sub-net, location and Owner of the computer system in question;

d.      The Local ITSO will disconnect the offending computer system from the network (or will disable network access by that computer, in cases where that is simpler or more appropriate);

e.       In cases where UCS deems that urgent action must be taken in view of actual or potential damage to University computer or network systems, then it may circumvent step (b) and take unilateral action, advising the Local ITSO afterwards of the action taken and the reasons for doing so.