WSB Policy: Electronic Communications

Purpose

1. The World Scout Bureau (WSB) is committed to providing an effective and efficient Electronic Communication service as part of its Information Technology (IT) resources.
2. The WSB is committed to the correct and proper use of its electronic communications encompassing facilities such as email, internet, video conferencing, voice conferencing, fax, telephony and direct messaging services in support of its administrative, service and operational functions.
3. The inappropriate use of WSB’s electronic communication services could expose the organisation to risks ranging from virus attacks, theft and disclosure of information, disruption of network systems and services and litigation.
4. The purpose of this policy is to define acceptable use of WSB’s electronic communications,
5. This policy is mandatory and by using any of the WSB’s electronic communications services, users are agreeing to abide by the terms of this policy.
6. This policy document is read along with:
   • WSB Acceptable Technology Use
   • WSB Information Security Policy
   • WSB Password Standards Policy

Scope

This policy represents the WSB’s official position and takes precedence over all other relevant policies which may be developed at a local level.

This policy encompasses electronic forms of communications such as:

• Electronic Mails (Emails)
• Internet
• Intranet
• Facsimile
• Video Conferences
• Voice Conferences
• Telephony Services
• Direct Messaging / Mentions via Slack, Zoom, Office 365 (including any other platforms that includes chat/direct messaging services).
• Mentions on social media on other Information System platforms used by the WSB.

This policy applies to:

• All WSB offices globally.
• All staff, contractors, consultants, interns, volunteers and third-party commercial service providers authorised to use the WSB’s Information Technology resources for electronic communications.
• All use (both personal & WSB business related) of the WSB’s electronic communications services.
• All connections to (locally or remotely) the WSB’s electronic communication services.
• All connections made to external networks through the WSB’s Information Technology (IT) network.

Definitions

A list of terms used throughout this policy are defined in Appendix A.

Policy

Principles of Acceptable Use

The acceptable use of the WSB’s electronic communications services is based on the following principles:

1. Access to the WSB’s email and internet facilities should be regarded as a business requirement and not an automatic entitlement.
2. Users have a responsibility to ensure that they use WSB’s electronic communication facilities at all times in a manner which is lawful, ethical and efficient.
3. Users are expected to respect the rights and property of others, including privacy, confidentiality and intellectual property.
4. Users are expected to respect the integrity and security of the WSB’s electronic communication services.

Monitoring

1. The WSB reserves the right to routinely monitor, log and record any and all use of its electronic communications services for the purpose of:
   • • Helping to trace and resolve technical faults.
     • Protecting and maintaining network and system security.
     • Maintaining system performance and availability.
     • Ensure the privacy and integrity of information stored on the WSB network.
     • Investigating actual and suspected security incidents.
     • Preventing, detecting and minimising inappropriate use.
     • Protecting the rights and property of the WSB, its staff, contractors, consultants, interns and volunteers.
     • Ensuring compliance with WSB policies, current legislation and applicable regulations.
2. While the WSB does not routinely monitor an individual user’s use of its electronic communications services, the WSB reserves the right to do so when a breach of its policies or illegal activity is suspected.
3. The monitoring of an individual user will only be undertaken at the request of the individual’s line manager and the HR Manger.
4. The monitoring may include but is not limited to details of internet sites visited, time spent on sites, pages viewed, information downloaded and the contents of email messages.
5. The WSB will at all times seek to act in a fair manner and respect the individual user’s right for the privacy of their personal data under the relevant local Data Protection Acts.
6. Personal information collected through monitoring will not be used for purposes other than those for which the monitoring was introduced, unless it is clearly in the user’s interest to do so or it reveals activity that the WSB could not be reasonably expected to ignore, for example a user found to be viewing, downloading or forwarding appropriate content, which then requires the WSB to act upon such transgressions.
7. Individual monitoring reports will only be accessible to the appropriate authorised WSB personnel and will be deleted when they are no longer required.
8. In the process of dealing with computer support calls, WSB IT coordinators may need to access a user’s computer to resolve the support call. In such circumstances IT coordinators must respect the privacy of the individual user and not access information, documents or emails of a personal nature without the user’s permission or unless they need to in order to resolve the support call. In some cases, the IT coordinators may use remote control software to connect and take control of a user’s computer remotely. In such circumstances the IT coordinators will not use this software to connect to the user’s computer without first attempting to contact the user of the computer first.

Personal Use

1. The WSB’s electronic communications services are to be used primarily for WSB business-related purposes. However, at the discretion of their line manager occasional personal use may be permitted by a user provided it:
   1. • Is not excessive.
      • Does not take priority over their WSB work responsibilities.
      • It does not interfere with the performance and work of the user, other staff or the WSB.
      • Does not incur unwarranted expense or liability for the WSB.
      • Does not have a negative impact on the WSB in any way.
      • Does not involve commercial activities, such as running any sort of private business, advertising or performing work for personal gain or profit.
      • Is lawful and complies with this policy and all other relevant WSB policies.
   2. The WSB has the final decision on deciding what constitutes excessive personal use.
   3. The WSB does not accept liability for any fraud or theft that results from a user’s personal use of the WSB’s electronic communications services.

Electronic Mail (Email)

1. The primary purpose of the WSB email system is to promote effective communication on WSB business matters.
2. Users must respect the privacy of others at all times and only use email accounts that have been issued to them.
3. Users who use the email system for personal use must ensure they present their communications in such a way that it is clear to the recipient that the email is of a personal nature and is not a communication on behalf of the WSB.
4. Users should be careful when using their WSB email account to send personal messages that their words or actions do not have a negative impact on the WSB in any way.
5. Only email facilities provided by the WSB may be used in connection with an individual user’s work for the WSB. The use of third-party web-based email services for the transmission of WSB confidential or restricted information is strictly prohibited for staff members of the WSB.
6. For security reasons users who regularly receive WSB confidential or restricted information via email must not forward their WSB email messages to their own personal third-party web-based email account.
7. Users should ensure they keep their personal email messages separate from their WSB business related email messages.
8. In circumstances where it is necessary to transmit confidential or restricted information via email the sender must ensure the following checks are carried out before sending the information:
   • • The name and email address of all the intended recipient(s) are correct.
     • The email message is clearly marked as “Private & Confidential".
     • Only the minimum amount of confidential or restricted information as is necessary for a given function(s) to be carried out is to be sent.
9. Where it is necessary to transmit confidential or restricted information to an email address outside of the WSB domain (i.e. one that does not end in “@scout.org”), the sender must ensure the following additional checks are carried out before and after sending the information:
   • • Where practical check that the email message and information have been received by the intended recipient(s) (i.e. ask for a delivery receipt or phone the intended recipients to confirm receipt).The transfer of the information is legally justifiable in accordance with the relevant Data Protection Acts. If the sender is unsure about this they should contact the Relevant WSB staff member.
     • Where possible, all confidential or personal information sent with the email message is to be encrypted.
     • The password used to decrypt (read) the confidential or restricted information must not be sent along with the original email message.
10. Where there is a business need, WSB line managers may apply to the IT Coordinators to have a generic or group WSB email address created which will be shared by multiple users.
11. Users who require their secretaries or other colleagues to have access to their mailbox or calendars should setup shared mailboxes and calendars as necessary, rather than sharing their usernames and passwords.
12. Email distribution lists must only be used for the authorised distribution of WSB work-related information which is relevant to everyone on the list.
13. Emails carries the same legal status as other written documents and should be used with the same care.
14. Emails are capable of forming or varying a contract in the same way as a written letter. Users must be careful when wording an email, so it cannot be construed as forming or varying a contract when this is not the intention.
15. A disclaimer must be automatically attached to all WSB out-going email messages. This disclaimer does not excuse the user from undertaking fundamental checks before sending the email (i.e. checking the email content for accuracy, correct address etc.).
16. During planned periods of absence such as career breaks, holidays or on training courses users should ensure where practical, their mailbox has an “Out of Office” message notifying senders accordingly. Alternatively, users may also set up an auto-forwarded to redirect emails to another named recipient during this period.
17. Users leaving the employment of the WSB must ensure they forward on all important WSB business related email messages to their line manager or work colleagues before they leave so that there is no disruption to service delivery after they leave. They should also ensure they remove or delete all personal email messages (i.e. email messages which are of a personal nature and are not WSB business related) from their WSB mailbox before they leave as it may not be possible to get a copy of these once they have left the WSB.
18. All email accounts maintained on the WSB email system are the property of the WSB.
19. 3^rd Party applications using office 365’s authentication is to be reviewed yearly by the Office 365 Admin. Applications no longer in use should be de-authorised from using Office 365 as authentication medium.
20. Security is a paramount concern and as such, when a user receives an email that looks like spam, please check in with the IT Personnel or the Senior Manager, Digital & IT Services. Please do not click on any links in the email as in doing so, the user risks exposing themselves to an IT Security incident.

Internet

1. Internet usage is permitted and granted to all WSB staff, contractors, consultants, interns and volunteers for the sole purpose of supporting the goals and business activities of the WSB.
2. All users must exercise good judgment in using the Internet as any files or folders downloaded from the Internet may contain virus, malware and other malicious content that could be detrimental to the WSB and to the user’s computer.
3. The WSB will not be held liable for any financial or material loss by an individual user while accessing the internet for personal use.
4. Users should be aware that information hosted on the internet offers no guarantee of accuracy, reliability or authenticity.
5. Using the WSB Information Technology (IT) resources to access the Internet for personal purposes is permitted to an acceptable level. Please refer to the WSB Acceptable Technology Use Policy for what is considered to be acceptable level of use.
6. Users who choose to store or transmit personal information such as private keys, credit card numbers or certificates or make use of Internet "wallets" do so at their own risk. The company is not responsible for any loss of information, such as information stored in the wallet, or any consequential loss of personal property.
7. Acquisition, storage, and dissemination of data which is illegal, pornographic, or which negatively depicts race, sex or creed is specifically prohibited.
8. The WSB also prohibits the conduct of a business enterprise, political activity, engaging in any form of intelligence collection from our facilities, engaging in fraudulent activities, or knowingly disseminating false or otherwise libellous materials.
9. Other activities that are strictly prohibited include, but are not limited to:
   • Deliberate pointing or hyper-linking of company Web sites to other Internet/WWW sites whose content may be inconsistent with or in violation of the aims or policies of the WSB.
   • Any conduct that would constitute or encourage a criminal offence, lead to civil liability, or otherwise violate any regulations, local, state, national or international laws.
   • Use, transmission, duplication, or voluntary receipt of material that infringes on the copyrights, trademarks, trade secrets, or patent rights of any person or organisation. Assume that all materials on the Internet are copyright and/or patented unless specific notices state otherwise.
   • Transmission of any proprietary, confidential, or otherwise sensitive information without the proper controls.
   • Creation, posting, transmission, or voluntary receipt of any unlawful, offensive, libellous, threatening, harassing material, including but not limited to comments based on race, national origin, sex, sexual orientation, age, disability, religion, or political beliefs
   • Any form of gambling.
10. Bandwidth both within the WSB and in connecting to the Internet is a shared, finite resource. Users must make reasonable efforts to use this resource in ways that do not negatively affect other employees. Specific departments may set guidelines on bandwidth use and resource allocation and may ban the downloading of particular file types.

Social Media

1. The WSB permits access to all social media sites without any technology-based restrictions in place.
2. Users should be aware that all use of social media, either in a personal capacity or when communicating on behalf of the WSB must be in accordance to the WSB Social Media Policy.
3. Confidential or restricted information regarding WSB business practices and procedures or personal information about any WSB staff, contractors, consultants, interns and volunteers must not be posted or discussed on any social media websites.

Fax

1. Users must respect the privacy of others at all times and only access fax messages where they are the intended recipient, or they have a valid WSB work-related reason.

    

2. Users who receive fax messages where they are not the intended recipient must contact the sender and notify them of their error and destroy or return the fax message as directed by the sender.

3. Users need to consider whether a fax is the most appropriate means of communication. Confidential and personal information should not be transmitted by fax. Where possible the information must be encrypted and transmitted via email.

Security

1. Users who breach information security by inadvertently transmitting confidential, restricted or personal information by fax, email or the internet to an incorrect address or destination, must follow the procedure below:
   • • The breach must be managed and reported it to the IT Coordinators and/ or Line Manager.
     • The user must contact the recipient of the fax, email or internet message immediately and request that the information is returned to the WSB immediately or destroyed.
2. Viruses and other forms of malicious software are usually spread via email and the internet. Users who receive a virus warning message must notify the IT Coordinators and under no circumstances should they forward it on to other users.
3. The WSB’s electronic communication services may not be used:
   • • For excessive personal use.
     • For commercial activities, such as running any sort of private business, advertising or performing work for personal gain or profit.
     • For political purposes, such as promoting a political party / movement, or a candidate for political office, or campaigning for or against government decisions.
     • To knowingly misrepresent the WSB.
     • To enter into contractual agreements inappropriately (i.e. without authorisation or where another form of agreement is required)
     • For any activity that would infringe intellectual property rights (e.g. unlicensed installation, distribution or copying of copyrighted material)
     • To send messages that contain libellous, defamatory or harassing remarks, images or other material.
     • To bully others
     • For creating or transmitting “junk” or “spam” emails. This includes but is not limited to unsolicited commercial emails, jokes, chain-letters or advertisements.

     • For any activity that would constitute a criminal offence, give rise to a civil liability or otherwise violate any law.

     • For any activity that would deliberately compromise the privacy of others.

     •  For any activity that would intentionally waste the WSB’s resources (e.g. employee time and IT resources).

     • For any activity that would intentionally compromise the security and availability of the WSB’s IT services (e.g. by deliberately or carelessly causing computer virus and malicious software infection).

     • To transmit confidential or personal information outside the WSB unless the information has been encrypted (email and internet).

     •  To create, view, download, host or transmit material of a pornographic or sexual nature or which may generally be considered offensive or obscene and could cause offence to others on the grounds of race, creed, gender, sexual orientation, disability, age or political beliefs. Material is defined as information (irrespective of format), images, video clips, audio recordings etc.

     • To forge or attempt to forge an email message or, send an email message using another person’s account without their permission.

     • To upload or download access-restricted WSB information contrary to this policy or in violation of any other WSB policy.

4. The above list should not be seen as exhaustive, as other examples of unacceptable use of the WSB’s electronic communications services may exist. 

5. The WSB has the final decision on deciding what constitutes excessive personal use. The WSB will refer any illegal use of its electronic communications to the relevant authorities.

Roles & Responsibilities

Policy Distribution & Awareness

This policy and it's supporting policies, standards and guidelines will be published on the WSB Dropbox.

Soft copies of the policy and its supporting policies, standards and guidelines will be available on WSB Staff Support Center.

The IT Personnel and/or the Senior Manager, Digital & IT Services may make periodic policy announcements by email.

WSB line managers will ensure that all existing and new staff, contractors, consultants, interns, volunteers and third-party commercial service providers who report to them are made aware of and have access to the policy and its supporting policies, standards and guidelines.

Individuals requiring clarification on any aspect of the policy and its supporting policies, standards and guidelines and/or advice on general I.T. security matters may email their queries to the Senior Manager, Digital & IT Services or the local IT Personnel.

Exceptions to this Policy

Exceptions to the guiding principles in this policy must be documented and formally approved by the Global Director, Communications , with evidence of support from the appropriate Senior Management Team.

Policy exceptions must describe:

• The nature of the exception.
• A reasonable explanation for why the policy exception is required
• Any risks created by the policy exception.
• Evidence of approval.

Policy Enforcement

The WSB reserves the right to take such action as it deems appropriate against individuals who breach the conditions of this policy. WSB staff, contractors, consultants, interns and volunteers who breach this policy maybe subject to disciplinary action, including suspension and dismissal as provided for in the WSB disciplinary procedure.

Breaches of this policy by a third-party commercial service provider, may lead to the withdrawal of WSB information technology resources to that third party commercial service provider and/or the cancellation of any contract(s) between the WSB and the third-party commercial service provider.

The WSB reserves the right to refer any use of its IT resources for illegal activities to the relevant Authorities.

Review & Update

This policy will be reviewed and updated annually or more frequently if necessary, to ensure any changes to the WSB’s organisation structure and business practices are properly reflected in the policy.

Appendix A: Definitions

Information: Any data in an electronic format that is capable of being processed or has already been processed.

Information Technology (I.T.) resources: Includes all computer facilities and devices, networks and data communications infrastructure, telecommunications systems and equipment, internet/intranet and email facilities, software, information systems and applications, account usernames and passwords, and information and data that are owned or leased by the WSB.

IT Personnel: These are the individuals responsible for the day to day management of a WSB network domain. Also includes WSB personnel who have been authorised to create and manage user accounts and passwords on a WSB network domain

Line manager: The individual a user reports directly to.

Password: A string of characters that a user must supply in order to gain access to an IT resource.

Process / Processed / Processing: Performing any manual or automated operation or set of operations on information including:

1. Obtaining, recording or keeping the information.
2. Collecting, organising, storing, altering or adapting the information.
3. Retrieving, consulting or using the information.
4. Disclosing the information or data by transmitting, disseminating or otherwise making it available.
5. Aligning, combining, blocking, erasing or destroying the information.

Users: Any authorised individual who uses the WSB’s IT resources.