Acting against the rules and regulations concerning university’s information systems and other IT services as well as acting against Finnish laws, governing information security, data privacy and cybersecurity, will be treated as IT offences or violations at Metropolia University of Applied Science.
This document outlines the actions taken against an individual when an IT offense has been discovered or there is reason to believe that an offense has occurred. The sanction practices vary from minor user permission restrictions to more severe penalties, depending on the nature of the action, whether the offense results from negligence, deliberate actions, or criminal intent.
Security breach is prohibited by law because it involves attempting unauthorized intrusion into a computer system, service, or device, or unauthorized use of an application with obtained credentials. |
The guideline concerns primarily on the university’s degree students and personnel.
User credentials and permissions to access university systems may also be given to:
Due to the group's heterogeneity, decisions regarding IT violations will require more individual considerations. Instead of providing general one-size-fits-all solutions for IT offenses, the principle of discretion applies to the case at hand.
All occurred IT offences and actions must be reported to the Chief Information Security Officer.
User permissions may be restricted by either disabling some or all of a person's user accounts or by employing other methods to prevent access to an information system (e.g., removing modify permissions) during the investigation:
User permissions will be restricted in cases where there are reasonable grounds to suspect misuse of university IT resources, when access rights hinder the investigation of an offense, or to prevent potential further harm.
The decision to restrict user permissions is made by the owner of the information system in question, the unit leader, or an appointed individual. The implementation of these restrictions falls under the responsibility of the administrator. In urgent situations, the administrator may autonomously restrict user permissions for a maximum of three days and will promptly report this action to the designated authority.
In minor offences the user is verbally reprimanded for improper action.
The person committing an IT offence is liable for the costs incurred from the use of resources (e.g. computer time) as well as for the costs incurred from the investigation.
A student may be subject to the following consequences: restriction of user permissions (disabling of user accounts) (General Policy of the Use of Information Systems), the university's internal administrative actions (a written warning, a temporary dismissal) (Polytechnics Act 14.11.2014/932), and reporting a crime (actions punishable by law).
The university teachers or the other representative of the university, such as the staff, the teacher’s supervisor or the Board of Examiners, are standardly responsible for handling a student’s IT offence at Metropolia. In minor cases and due to negligence, the student is simply addressed verbally.
The decision to disable a user account is made by the university's President or someone else appointed by the President. The restriction time does not include the time that the account is disabled pending investigation.
The decision to give a written warning is made by the university's President, while the temporary suspension of the student decides the Board of Directors. Access rights into the university’s IT services will be withdrawn during the suspension period.
The IT Services do not serve as a disciplinary measure. Instead, instances of IT violations by students will be addressed according to the university's disciplinary guidelines.
A student insults or bullies other students, staff, visitors or other people he or she works with in connection with studies or a work placement, or reveals their personal data to a third party or otherwise acts in violation of data protection rules and guidelines. A student intentionally or through gross negligence damages property at Metropolia or at a work placement or property belonging to a partner. |
A student poses a threat to public safety or causes significant damage to Metropolia. A student reveals to a third party the personal data, including sensitive personal data, of other students, staff, visitors or other people he or she works with in connection with studies or a work placement, or otherwise acts in violation of data protection rules and guidelines, and does so repeatedly or in a manner that can be considered deliberate or gross. A student accesses a forbidden domain in an information network, causes an information security threat or causes damage to an information system. |
A staff member may face the following consequences: disciplinary actions outlined in labor law (including a written warning, dismissal, or termination of employment contract) as per the Employment Contracts Act (Chapter 7, Section 2; Chapter 8, Section 1), and reporting to law enforcement for criminal actions. Warnings are issued by the head of the unit or the director of administration. Access to specific information systems may be temporarily or permanently disabled based on trust concerns resulting from misuse. When determining consequences, the intent and severity of the offense are considered.
Distributing material subject to criminal law such as:
Unlawful distribution of material subject to copyright law such as:
Giving one's login credentials to someone else:
Risking data integrity:
Tietotekniikkarikkomusten seuraamuskäytäntö