Monitoring/ tracking software on university provided devices

Rajai Davies made this Rhyddid Gwybodaeth request to University of the Highlands and Islands

Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

Roedd y cais yn llwyddiannus.

Dear University of the Highlands and Islands,

I am writing to request the following information under FOISA.

Please provide me with the full details (name, type, data/ activity category, device type, user type) of any electronic software or means currently used to track, surveille, monitor, or log the operational activity/ use by any users (students or staff) of university-provided devices - including devices such as phones, laptops, tablets, desktops, and including monitoring or recording activities such as:

Keystrokes/ mouse clicks
Internet activity
Network activity
Software use/ installed software list
Active windows
Login/ logout times
Instant messaging
Social media posts
Email
Data traffic (incoming or outgoing)
Device location

Where any of the above types of activity is being tracked or monitored by university staff or others on its behalf please provide with me details of how these tracked data are being stored, how they are secured, which category of employees can view these data, for what purposes these data are being processed/ stored, and your retention policy for these data.

Yours faithfully,

Rajai Davies

FOI, University of the Highlands and Islands

Dear Rajai,

Re: Freedom of Information (Scotland) Act 2002 – Request for Information

Thank you for your enquiry, which has been logged and passed to the relevant department within the University for processing. Please quote reference number FOI 057 should you need to contact the University regarding this request.

A response will be sent to you promptly and in any case not later than 20 working days after the date we received your email. The University will make every effort to provide you with the information requested; if any clarification is required, the University will contact you as soon as possible.

In some circumstances, it may not be possible to provide you with an answer to your enquiry. Where the University believes this is the case, you will be informed in writing, stating the reason(s).

If the information you are seeking is already published by the University, or is otherwise available to members of the public, you will be sent details outlining how to access the information.

You will be advised if it is necessary for the University to charge a fee to cover the costs of processing your request. Should this be the case, please note the information cannot be released until such payment is received.

If you have any questions regarding your request for information then please do not hesitate to contact me.
Yours sincerely,

Christine Shaw
Corporate Governance Officer
Oifigear Riaghlaidh Corporra

University of the Highlands and Islands, Ness Walk, Inverness IV3 5SQ
Oilthigh na Gàidhealtachd agus nan Eilean, Slighe Nis, Inbhir Nis IV3 5SQ
DDI / Fòn: +44 (0) 1847 889380 Lìn | Web: www.uhi.ac.uk

Pròiseact crannchuir Coimisean nam Mìle Bliadhna. Na companaidh earranta clàraichte ann an Alba, Àireamh 148203. Àireamh Carthannas Albannach Clàraichte SC022228. Oifis chlàraichte 12b Slighe Nis, Inbhir Nis, Alba, IV3 5SQ
A Millennium Commission lottery project. A limited company registered in Scotland no. 148203. Scottish charity no. SC022228. Registered office: 12B, Ness Walk, Inverness IV3 5SQ.

dangos adrannau a ddyfynnir

FOI, University of the Highlands and Islands

Dear Rajai,

Re: Freedom of Information (Scotland) Act 2002 – Request for Information

I refer to your request for information received on the 10 July 2020, relating to the monitoring/tracking software on university provided devices - FOI 057. Please see our response as follows:

The University does not carry out any surveillance activity related to its staff or students. We maintain firewall logs for the purposes of investigating any malicious or illegal activity. Software distribution and licensing is maintained by Microsoft SCCM and applies to all sites. This will record all software that is installed and properly licensed for use by the University for its corporate devices.

Corporate portable devices such as phones, tablets and laptops are secured using Microsoft intune to allow the device to be remotely wiped should it be lost or stolen.

Only Admins for the various support functions that maintain these areas have access to these logs/systems.

Please note that information relating to retention periods and policies in relation to the operation of firewall logs has been withheld from this response. This is because the University considers that the release of this information may compromise important information security controls. Accordingly, this information has been withheld from disclosure in accordance with S.30(c) of the Freedom of Information (Scotland) Act. Please treat this email response as notice of that as per S.16 of the Act.

Live hardware inventories of corporate only devices are retained within SCCM for up to 45 days, depending upon the frequency of hardware or software changes to the device. The Hardware inventory details include information like, memory, operating system, manufacturer, device types, peripherals, etc.

The university follows Intune polices as defined by Microsoft - further information can be found here.
http://download.microsoft.com/download/c...

The University operates as a collegiate federal partnership comprising of thirteen independent further and higher education colleges, specialist colleges and research institutions. A list of contact details for our partner organisations is available at http://www.uhi.ac.uk/en/campuses and further information about the University is available online at http://www.uhi.ac.uk/en

Your right to seek a review of our decision If you are not satisfied with our response or our reasoning set-out above, you have forty working days in which to request a review of our decision. Any request should be put in writing and should be sent to me at the address detailed at the bottom of this email. Your request should:

(a) describe the nature of your original request; and
(b) explain the reasons why you are not satisfied with our response.

If you remain dissatisfied with how your request for information has been dealt with, you also have the right to apply to the Scottish Information Commissioner for a decision as to whether we have handled your request properly.

Information relating to your right to seek review is available from the Scottish Information Commissioner's web page at: http://www.itspublicknowledge.info/faqs.... or by contacting the Scottish Information Commissioner's Office at the following address:

Scottish Information Commissioner, Kinburn Castle, Doubledykes Road, St Andrews, Fife,
KY16 9DS
Telephone: 01334 464610
Fax: 01334 464611
E-mail: [email address]
Website: www.itspublicknowledge.info

Yours sincerely
Christine Shaw

Corporate Governance Officer
Oifigear Riaghlaidh Corporra

University of the Highlands and Islands, Ness Walk, Inverness IV3 5SQ Oilthigh na Gàidhealtachd agus nan Eilean, Slighe Nis, Inbhir Nis IV3 5SQ
DDI / Fòn: +44 (0) 1847 889380 Lìn | Web: www.uhi.ac.uk

Pròiseact crannchuir Coimisean nam Mìle Bliadhna. Na companaidh earranta clàraichte ann an Alba, Àireamh 148203. Àireamh Carthannas Albannach Clàraichte SC022228. Oifis chlàraichte 12b Slighe Nis, Inbhir Nis, Alba, IV3 5SQ A Millennium Commission lottery project. A limited company registered in Scotland no. 148203. Scottish charity no. SC022228. Registered office: 12B, Ness Walk, Inverness IV3 5SQ.

dangos adrannau a ddyfynnir