The substitute follows the draft’s outline, so each section can be offered as a replacement for the draft section of the same number. Sections IV and V are new.

Administrative Regulation — Information Technology Resources, Information Security and Privacy

I. Scope and Principles

This Administrative Regulation governs the use, security and privacy of technology resources that the University owns, leases or operates. It applies to students, faculty, staff, contractors, visitors and authorized third parties who use those resources.

For the avoidance of doubt, this regulation does not govern services, platforms or forums that others operate, such as the discussion lists of scholarly and professional societies, publishers’ and conference websites, and social media services, including when a user reaches them from a University account, device or network, or has access to them because of the user’s University position or the University’s membership in the organization that operates them. It does not govern the content of personally owned devices or accounts.

The President, through the Executive Vice President for Finance and Administration, delegates to the Enterprise Chief Information Officer (Enterprise CIO) authority to set technical, security, procurement and operational requirements for University technology resources, consistent with this regulation. That authority does not include restricting the content of communications, the personal use permitted by Section II.C.2 or the privacy protected by Section II.C.3. Any such restriction may be adopted only as Section IV provides.

Academic freedom and free expression. The University does not wish to be the arbiter of the content of electronic communications. The First Amendment, Sections 1 and 8 of the Kentucky Constitution and the principles of academic freedom apply in full to the use of University technology resources. Like other citizens, faculty members are free to engage in political activities. The University does not restrict communications over its technology resources because of their content or viewpoint, except as Section II.C.1 provides. A communication does not become the University’s speech, or speech made pursuant to a user’s official duties, because it is made with a University account, device or network, and no disclaimer is required for it.

A. Definitions

1. “University technology resources” means software, data, accounts, devices, licenses and networks that the University owns, leases or operates. A personally owned device or account is not a University technology resource, even when it connects to a University network. While connected, it is subject only to the network-security requirements of Section III.
2. “Cloud-based services” shall mean those data-control and sharing services in which data is typically distributed across multiple off-site servers, infrastructure or both. Typically, this service is by subscription with a third-party provider. University data stored within cloud-based services are still the property of the University. A user’s personal files stored in a University cloud account are not University data for purposes of this regulation. This regulation does not give the University ownership of any intellectual property. A faculty member’s scholarly and creative works, including books, articles and course materials, and a user’s personal files do not become University property or University data because they are created with, stored in or sent through University technology resources.
3. “Personal files” means files and communications that a user creates, receives or keeps for personal, family, extramural or citizen purposes, as distinguished from records of University business. A faculty member’s scholarly and teaching materials in progress receive the same protection as personal files. A file is not a record of University business merely because it is stored on a University technology resource.
4. “University distribution lists” means email lists that the University generates from its records to reach all students, all employees, or all members of a University-wide category such as all faculty or all staff. Lists of a college’s or department’s faculty, faculty listservs, subscription lists, and discussion groups that members may join or leave are not University distribution lists.
5. “Official University accounts” means websites and social media or email accounts that speak for the University or one of its units, such as a college’s social media account. A user’s individual University email account is not an official University account.

II. University Technology Resources

A. Oversight of University Technology Resources

Information Technology Services (ITS) administers the procurement, management and terms of use for the voice system, University technology resources and networking infrastructure, including cloud infrastructure.

The Enterprise CIO establishes ITS processes for the selection and approval of all related procurements of hardware, software and cloud-based services. ITS will coordinate procurement activity with Procurement Services and will follow Administrative Regulation — Contracting Authority, Procurement and Disposal of University Property and Other Delegated Authority.

The Enterprise CIO is responsible for administering the University’s technology resources, access to those resources and authorizing any computing systems used for University activity or connected to University technology resources.

The Enterprise CIO may create policies to evaluate the potential impact of new and emerging technologies on University operations including, but not limited to, artificial intelligence and ensure the security and protection of University technology resources.

Procurement and approval processes under this section are limited to security, legal, accessibility, data-protection and contractual requirements. They must be published and must provide decisions within a stated time. They may not be used to restrict the subject matter, methods or tools of teaching or research, including the use of artificial intelligence in teaching and research.

B. Access to University Technology Resources

University technology resources support teaching, research, scholarship, service, patient care and the work of the University, and they are also open to the expression, communication among colleagues and incidental personal use that this regulation protects. Faculty, staff and students receive the access that their teaching, research, study, service and work require, and that access may be limited or withdrawn only as Sections II.C and III.D provide. The Enterprise CIO will establish policies on accounts, authentication, and the methods and duration of access, consistent with this regulation.

C. Use, Privacy and Access

1. Prohibited uses. Users may not use University technology resources to:
   1. violate federal, state or local law;
   2. advocate for or against a public question on the ballot, to the extent KRS 48.025 prohibits;
   3. use University distribution lists or official University accounts to support or oppose a candidate for public office, or solicit contributions for a candidate, party or political committee;
   4. operate a business or promote a commercial product or service for private gain, except as another regulation permits, including consulting and other professional work approved under Administrative Regulation 3:9 (Consulting and Other Overload Employment) and licensing, commercialization and start-up activity conducted under the University’s intellectual property regulations. Sharing research results, software and scholarly works with industry collaborators or the public is not the promotion of a commercial product;
   5. send commercial electronic mail in bulk, or post to a University distribution list without the posting permission the list provides (the University assigns posting permission by office or role, publishes who holds it, and never grants or withholds it because of a message’s content or viewpoint);
   6. forge or falsify the sender, header or routing information of a message, or impersonate another person with intent to deceive;
   7. use another’s credentials, gain access without authorization, circumvent security measures, introduce malicious software, or intentionally disrupt or degrade the technical operation of University systems, as by a denial-of-service attack; or
   8. infringe a copyright or software license.
   No other prohibition applies to the content of communications. Expression protected by the First Amendment, Sections 1 and 8 of the Kentucky Constitution or academic freedom does not violate item 1, and an allegation that a communication constitutes harassment is not a ground for access under Section II.C.4 unless the communication is alleged to be directed at a particular person and to be so severe, pervasive and objectively offensive that it denies equal access to education or employment. Teaching, research and scholarship about candidates, parties and ballot questions, and the dissemination of their results, are not barred by items 2 and 3. Users may, among other things, communicate on any subject, including politics, religion and international affairs; post to personal social media and to outside websites, forums, listservs and discussion groups; take part in the forums of scholarly and professional societies; and circulate their own writings to colleagues, from University accounts, devices and networks.
2. Personal use. Incidental personal use is an accepted and appropriate benefit of being associated with the University’s technology environment, and it benefits the University by allowing users to avoid needless inconvenience. It is permitted so long as it does not interfere with the operation of University technology resources, interfere with the user’s duties, or impose a noticeable incremental cost on the University. A supervisor may limit a particular use only in writing, stating which of those conditions the use does not meet, and the user may seek review under Section III.D.4. Personal use may not be limited as a sanction, during an investigation, or because of the content or viewpoint of the user’s communications. Direct costs of personal use, such as printing supplies, are borne by the user.
3. Privacy. The University respects the privacy of electronic files and communications in the same way that it respects the privacy of paper correspondence and telephone conversations. Users have a reasonable expectation of privacy in their personal files, including personal files on University devices and in University accounts. The University does not examine or disclose the content of a user’s files or communications without the user’s consent, except as Section II.C.4 provides. Personal files are not records of University business and are not public records of the University. If the University receives a request under the Kentucky Open Records Act that it believes reaches a user’s file, it will notify the user before responding, will not disclose a personal file, and will assert every applicable exemption, including KRS 61.878(1)(a).
4. Access without consent.
   1. Grounds. The University may examine the content of a user’s files or communications without consent only when a statute, warrant, subpoena or court order specifically requires access to the particular files; when there is substantiated reason, meaning reliable evidence as distinguished from rumor, gossip or other unreliable evidence, to believe that the user has violated law or Section II.C.1 and access is necessary to investigate it; when failure to act might result in significant bodily harm, significant property loss or damage, or a compromise of the security of University systems; or when the user is unavailable because of death, incapacity or separation and access is needed to continue University business. Access may never be used to investigate or sanction a communication that Section II.C.1 permits.
   2. Authorization. Access must be authorized in advance and in writing by two officials. For faculty, they are the Provost and the dean of the faculty member’s college; for staff, the Executive Vice President for Finance and Administration and the head of the employing unit; for students, the Vice President for Student Success and the Dean of Students. This authority may not be delegated. An official who is a complainant, witness, investigator, decision-maker, adviser or counsel to the University, or party to litigation in a matter involving the user, or who has publicly characterized the user’s expression or taken part in the decision to investigate it, may not authorize access or appoint an alternate. The Technology Rights Review Committee under Section III.D.4 names the alternate and decides any dispute over disqualification. The authorization must state the ground, the facts that support it, the files to be examined, and why a less intrusive means will not serve, and must weigh the need for access against academic freedom and personal privacy.
   3. Emergencies. In the emergencies described in item 1, the University may act at once, taking the least action necessary, and must obtain written authorization within two business days.
   4. Scope. Access is limited to the least perusal of contents and the least action necessary. Metadata is examined before content where it will serve. Review is limited to the dates and subjects stated in the authorization. Personal files are excluded unless the authorization specifically finds that a particular personal file is necessary. Information obtained may be used only for the purpose authorized.
   5. Notice. The University will notify the user before access, in time for the user to seek protection, unless a court order forbids notice or delay would create an imminent risk to human safety or University property, in which case notice will be given as soon as the risk passes. The notice will include the authorization and its reasons. Before releasing information in response to legal process, the University will notify the user.
   6. Records and oversight. Each authorization is recorded. A de-identified annual report of all access without consent is given to the Faculty Senate and published.
5. University-owned devices. The University may require the return of a University-owned device only at separation, for scheduled replacement, repair or upgrade, or when access to its contents is authorized under Section II.C.4 and a copy of the authorized records will not serve. Before return, the user may copy and remove personal files. When a device is needed under Section II.C.4, the user may first copy all personal files, and personal files are then excluded from review; any dispute over whether a file is personal is resolved under Section III.D.4 before the file is examined. The University will make a record of anything copied or removed and give the user a copy. It will image only the authorized records and return the original device to the user within ten business days, unless the user consents or a court orders otherwise. A replacement device does not substitute for return. A user who asserts privacy in good faith, or asks that a dispute be resolved before access, does not thereby fail to cooperate.

III. Cybersecurity and Data Security

A. Data Classification and Disclosure

The Enterprise CIO is authorized to categorize the types and sensitivity of data and establish compartmentalized access and usage rights. Training and reporting requirements may be assigned based on level of access authority.

B. Incident Response

All users with access to University technology resources must report suspected security incidents to ITS. ITS is responsible for monitoring security incidents centrally and initiating responses under the promulgated Cybersecurity Incident Response Plan. Failure to report suspected security incidents may result in termination of access to technology resources and/or disciplinary action as set out in Section III.D.4.

C. Research and Export Control

The Enterprise CIO and Vice President for Research shall jointly administer the University’s compliance with applicable export control laws and regulations, including requirements governing access to, use, disclosure, transfer or export of controlled technology, technical data, software, equipment and research information. The Enterprise CIO shall have primary responsibility for information technology security, access controls and protection of controlled technology and data within University technology resources. The Vice President for Research shall have primary, but not exclusive, responsibility for export control compliance associated with research activities, including the sharing or transfer of research information and materials, interactions with foreign persons and entities and applicable regulatory and reporting requirements.

Violation of applicable export control laws and regulations, including requirements governing access to, use, disclosure, transfer or export of controlled technology, technical data, software, equipment and research information may result in termination of access to technology resources and/or disciplinary action as set out in Section III.D.4.

Export control compliance under this section does not extend to information that arises during or results from fundamental research, or to information that is published or in the public domain, which federal law excludes from export controls. 15 C.F.R. §§ 734.3(b)(3), 734.7, 734.8; 22 C.F.R. § 120.34. The University will not monitor or restrict users’ communications with foreign colleagues about such research or information.

D. Monitoring and Enforcement

1. Systems monitoring. ITS may monitor University technology resources for security and system performance using automated tools and aggregate or non-content data. ITS staff may not seek out the content of communications, or transactional information about particular users, when it is not germane to system operations, and may not search content for violations of law or policy except under Section II.C.4. Monitoring beyond this paragraph is itself a violation of this regulation.
2. Investigations. An investigation of an alleged violation of Section II.C.1 proceeds under Section II.C.4. A user who has notice of an investigation must preserve relevant data. No user is required to waive privacy in personal files, any privilege, or any constitutional right.
3. Security holds. The Enterprise CIO may suspend an account’s or device’s access only to stop a specific, ongoing threat to the security or functioning of University systems, for no longer than necessary and for no more than 72 hours; any extension requires a written decision describing the threat, is limited to seven days, and may be renewed only by the Technology Rights Review Committee under Section III.D.4. The user will be notified as soon as practicable. A hold may not be imposed because of the content of a communication.
4. Sanctions and review. Any other limit on access, and any discipline, may be imposed only after written notice of the specific provision allegedly violated, an opportunity to respond and, if the user requests it, a hearing before the Technology Rights Review Committee under this paragraph before the limit takes effect. For faculty, discipline may be imposed only for the grounds, and through the procedures, set out in the Governing and Administrative Regulations and Kentucky law as in force when the investigation of the conduct began, with proof by clear and convincing evidence. A user may seek review of any limit on personal use, security hold, device demand or access decision from the Technology Rights Review Committee, which decides within ten business days. The Committee is a standing committee of faculty, staff and students chosen by the Faculty Senate, the Staff Senate and the Student Government Association.

IV. Implementing Policies

Policies, standards and procedures under this regulation are limited to technical, security, procurement and operational matters, and are published. A rule that would restrict the content of communications, personal use or privacy beyond this regulation, or add a prohibition, may be adopted only by Administrative Regulation under Section VI of the Administrative Regulation — Administrative Authority of the President, after the draft has been posted for campus comment for at least thirty days, after the Faculty Senate, the Staff Senate and the Student Government Association have each had at least thirty days to give their advice, and never on an interim basis.

V. Effective Date and Transition

This regulation replaces Administrative Regulation 10:1 and applies to conduct after its effective date. No provision of this regulation, and no change it makes, may be applied to conduct before that date, or in a pending matter, to a user’s detriment. No charge, finding or sanction may rest on any use of University technology resources that this regulation permits, whenever the use occurred. Adoption of this regulation does not ratify or validate any action, directive or investigation taken under AR 10:1 or any predecessor rule. Any limit on a user’s personal use, and any retention of a user’s device, imposed before the effective date that this regulation would not permit ends on that date.