UW Gazette, January 17, 1996
     
     A Web page is now available to explain how UW handles
complaints about misuse of computing facilities.
     Roger Watt, associate director of the department of
computing services, is author of the page, which discusses
complaints that might range from "abusive language" in elec
tronic mail to copyright violations. It was added to the
Web in early January.
     The page can be found on the Web at
http://www.dcs.uwaterloo.ca/dcs/complaints.html, or through
UWinfo under the department of computing services.
     From its text:
                                     ù
     Where complaints come from: From time to time, people
internal or external to UW send complaints about people who
are using UW computing and communications facilities in
manners considered unacceptable by those who submit the
complaints. The nature of the complaints has a wide range;
sometimes the complaint is about abusive language in mail
or a newsgroup posting; sometimes it is about the posting
of copyrighted software; sometimes it is about something
else.
     How we assess the validity of a complaint: How we
proceed depends on the nature of the activity that has
caused the complaint. The fact that someone is displeased
by an activity doesn't mean that the activity is invalid.
The first sentence of the university directive on the use
of UW computing and communications facilities provides a
"yardstick" against which a complaint can be measured; it
states that "Computing facilities at the University of
Waterloo, and the on-campus and off-campus electronic
communication systems by which they are interconnected and
accessed, exist to support the research, instructional and
administrative needs of the University.
     If it seems clear that the activity in question has
merit within the context of this statement, we convey that
back to the submitter in a manner that (hopefully) leaves
the submitter feeling welcome to pursue the matter further
by responding with additional information.
     Investigation and documentation: However, if it
appears that the activity in question may not be
supportable within the context of the statement, the next
step is to document the activity and notify the appropriate
person. This requires that we summarize the activity that
caused the complaint (excluding the complaint itself; most
people who submit such complaints ask not to be identified)
and explain the steps we followed to associate a specific
individual with the source of the activity.
     The process of associating a specific individual with
the source of an activity falls into one of two categories.
If the activity came from a single-user computer, then it
is simply a matter of looking at the network-connection
registration records to see the identity of the person to
whom that connection is registered. If the activity came
from a multi-user computer, then it is a matter of
backtracking through the various activity-log records gen
erated by computing-system software (mail-submission
records, news-posting records, computing-system or terminal-
server login records, gopher- or web-server records, etc)
in an attempt to identify the userid on that computer that
caused the activity.
     In the latter category, the process often requires
multiple steps and requires the cooperation of the UW
employee who is responsible for the "local system
administration" functions of that multi-user device. Here
is an example, outlining an investigation that occurred
1996-Jan-02.
     A person external to UW sent a complaint that four
postings involving copyrighted software and requests to
obtain copyrighted software had been submitted to a number
of "alt.binary" newsgroups by someone using UW computing
and communications facilities. The poster had attempted to
mask his/her identity by making the postings appear to have
come from a fictitious origin. However, the news-server
software that receives submitted postings identifies the
network address from which the posting was received, and
the date and time. In these four cases, the postings were
coming from IP addresses that map into domain addresses of
the form "cntsNp
MM.uwaterloo.ca". Those are the addresses that are
currently assigned to the campus-network terminal servers'
portsÉ terminal server N, port MM. For each of the four
postings, it was a matter of examining the terminal-server
login and logout records to identify the terminal-server
userid that was using that terminal-server port at that
time. In all four cases, it was the same userid. The person
using this userid had configured the news-posting software
on their modem-connected computer to submit the postings
under a fictitious name and domain address. Looking up the
identify of the person to whom that terminal-server userid
is registered was the last and the simplest step in the
investigate-and-document process.
     Reporting the complaint: Which person(s) we notify
depends on our perception of the seriousness of the
activityÉ
     ù the person who is the subject of the complaint,
     ù the person who is responsible for the administration
of the facility being used by the person who is the subject
of the complaint,
     ù the head of the department that contains the person
who is the subject of the complaint, and/or
     ù the member of the University Computing Committee
whose constituency contains the person who is the subject
of the complaint.
     At the same time, we also inform the person who
submitted the complaint that we have now forwarded the
matter to the appropriate person(s).
     References and conclusion: The enthusiastic reader may
wish to explore some of the related UW Policy documentsÉ
for example, #33 (Ethical Behaviour), #64 (Use of
Proprietary Computer Software), and #71 (Student Academic
Discipline).
     It seems sufficient to end this topic by citing the
last sentence of the University directive, on the matter of
"deliberate misuse": "Such misuse may lead to disciplinary
action within the University; it could also lead to civil
and/or criminal action."