An MUSC Manager's Guide to Searching Computers
An MUSC Manager's Guide to Searching Computers
Scope
If you work in a management or supervisory position at MUSC, and if you believe that you need to search an employee's computer workspace, and if the purpose of your search is to investigate suspected workplace misconduct by your employee, then you should find these guidelines helpful.
You should not search an employee's computer workspace if the primary purpose of your search is to investigate a crime suspected of the employee. In this context, a warrantless search by you as the employee's manager may render any evidence obtained as a result of the search inadmissable on constitutional grounds. You should report any suspected computer crime to MUSC Public Safety. See Appendix for examples of computer crimes.
The key distinction is between workplace misconduct and criminal activity. If you conduct a search and you discover evidence that leads to a criminal proceeding, then a legal determination of your intent when you conducted the search may determine the admissability of the evidence. So it's prudent to ask yourself this question up front, before proceeding further.
Background
For the purpose of this document, an employee's computer workspace is loosely defined to consist of the computer and network recources that are allocated specifically to the employee. This workspace often includes a computer workstation assigned to the employee, and it often includes other resources on the campus network, such as an e-mail account and a personal home directory on a file server.
Note that MUSC's Computer Use Policy grants employees a certain expectation of privacy with respect to the computer workstations assigned to them, with respect to their electronic communications (including e-mail), and with respect to files stored on network servers (including home directories).
Guidelines
Obtain clearance The legal and policy framework governing computer searches is complex. If you have any doubt as to whether a specific search which you are contemplating is both legal and in compliance with applicable MUSC policies, then you should consult with your management and/or with MUSC Legal Counsel.
Request technical support You may have the expertise and access rights needed to conduct a search of an employee's assigned workstation without any technical assistance. Often however, particularly if files or messages stored on network servers must be included in your search, you will need to request assistance from a system administrator in OCIO-IS. For the protection of all parties involved, your request to OCIO-IS should be made in writing, and it should be as specific as possible as to the nature of the data to be collected. You should copy your management, and MUSC Legal Counsel, with your request.
Conduct the search Keep in mind that the only purpose behind your search is to prove or disprove a suspicion of specific employee misconduct. You should protect the confidentiality of any other information you encounter in the course of your search, unless otherwise required by MUSC policy or by law.
Follow up Depending on the outcome of your search, and the seriousness of the evidence you discover, you may need assistance in the preservation of electronic evidence. Contact MUSC Human Resources if there is evidence of serious employee misconduct which could be contested by challenging the integrity of the electronic evidence. Contact MUSC Public Safety if, in the course of your search for evidence of employee misconduct, you discover evidence that warrants a criminal investigation.
Resources
- MUSC Computer Use Policy
- Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
Contacts
Office of the CIO - Information Services
Attn: Richard Gadsden, Director of Computer and Network Security
E-Mail: security@musc.edu
Office Phone: 843.792.8307
Fax: 843.876.5271$Id: computer-searches.html,v 1.3 2001/06/11 14:25:07 gadsden Exp $
Appendix: Examples of Computer Crimes
Counterfeiting money
Counterfeiting checks
Child pornography
Identity theft
Pyramid schemes
Theft
Obscene messages
Threatening messages
Fraud
Extortion (blackmail)
In addition to the above list, one can also find evidence implicating a person in other criminal activity where a computer is not used in the actual commission of the crime.