Investigating staff misuse of district technology.

School leaders need to be aware of how staff members are using the school district's technology and should take pro-active measures to prevent staff misuse of technology. School districts should have well-defined procedures in place for investigating staff misuse of technology and should follow those procedures when misuse is suspected.

While the measures below come from someone who serves as legal counsel to more than 75 school districts in Iowa, it is furnished with the understanding these suggestions do not constitute legal advice.

Clear Standards

The first thing each school district should do to limit staff misuse of technology is to have a comprehensive acceptable use policy for technology that, at a minimum, clearly sets out the following:

* staff members' use of district technology shall be for educational purposes only;

* access to the district's technology is a privilege, not a right;

* each staff member must have a signed acceptable use agreement on file prior to having access;

* inappropriate use of the school district's technology will result in the restriction and/or termination of the individual's access privilege and may result in disciplinary and/or legal action;

* the school district has the right, but not the duty, to monitor all aspects of its technology, including but not limited to, monitoring sites staff visit on the Internet and reviewing e-mail;

* the school district has the authority and right to examine all computer and Internet activity of any system user; and

* as a condition of use, staff members waive any right to privacy in anything they create, store, send, disseminate or receive via the school district's technology.

School districts also should perform random, routine checks of staff use of technology. The possibility of random, routine checks often has a deterrent effect on staff members who may be contemplating misusing school district technology. Although staff misuse of school district technology may be identified by random checks, in many instances school districts become aware of misuse through other means including concerns and/or complaints not necessarily related to technology made by parents, students and even other staff members. Often an evaluation of a staff member's computer provides important corroborative information to substantiate a complaint or concern the school district has received.

Secure Evidence

Once a school district believes a staff member may be using a computer inappropriately, the district should take control of the computer to prevent accidental or intentional deletion of the contents of the hard drive.

School district officials should not try to look at information on the computer, such as the user's Internet history or e-mail. If this is done, important evidence may be damaged or destroyed or the investigation and/or any evidence recovered will be compromised.

Instead the school district should use a computer expert to collect, preserve and analyze information on the computer. A school district technology coordinator may be used, but he or she must have the required expertise, objectivity and confidentiality to perform an effective investigation. The computer expert should be an experienced investigator familiar with a wide range of computer hardware, applications and operating systems, someone with expertise in the specialized tools and techniques to examine a hard drive and its contents and with experience in providing testimony in computer investigations.

The school district should establish and maintain an unbroken chain of custody of the computer prior to its delivery to the computer expert for analysis. This can be done by creating a detailed inventory of the computer involved, including the make, model, serial number, condition and capacity; and documenting when the computer was secured and how and when it was turned over to the computer expert for analysis.

Once the expert receives the computer, he or she should first create a complete non-invasive sector-by-sector backup of all data contained on the computer (a mirror image or clone) to recover all active, deleted and temporary files. This process creates a complete snapshot of the computer at the time it was secured and creates a backup copy to be examined by the expert so the original computer is not altered during the examination process.

Legal Assistance

This process is the only practical means of searching and analyzing all available computer files without altering critical information and compromising the investigation. In addition to examining the staff member's computer, the expert should review the school district's server to see whether other information such as e-mails and/or a log of the staff member's Internet use is available on the server.

Once the evaluation is completed, the school district should review the results of the evaluation with legal counsel to determine the appropriate steps to take.

Brett Nitzschke is an attorney with the Gruhn Law Firm, 4089 21st Ave., S.W., Suite 114, Cedar Rapids, IA 52404. E-mail: [e-mail]