View Current

Email and Internet Procedures

This is the current version of this document. To view historic versions, click the link in the document's navigation bar.

Section 1 - Purpose and Context

(1) These procedures provide information to assists students and staff to understand their rights and responsibilities while using Email and Internet services. These procedures should be read in conjunction with the Email and Internet Policy and Email and Internet Guide.

Top of Page

Section 2 - Definitions

(2) Refer to the Email and Internet Policy for a full list. Definitions that apply only for the purposes of these Procedures include:

Commercial Email: A commercial email sent by the University is an email designed to advertise or promote the University's services (or other similar opportunities).
Digital Signature: electronic code used to:
1. authenticate the identity of the sender of the email or document; and
2. confirm the email or document has not been altered since it was originally signed
Mailing List: list of email addresses hosted on servers using specialised mail list software to process incoming and outgoing messages (this policy does not address personal lists created in your local email software)

Top of Page

Section 3 - Policy Reference

(3) Refer to the Email and Internet Policy.

Top of Page

Section 4 - Procedures

Part A - Conditions of Use

(4) When using University email and internet, Authorised Users must:

respect confidentiality, privacy and legal/professional privilege, and ensure that the content and distribution of email will not undermine responsibilities in regard to these requirements [Ref. ISO 27002 section 13.2.3d];
ensure that their usage is legal and complies with all relevant University policies and procedures, in particular those governing records management (see the Records and Archives Management Policy and the Email and Internet Guide document for more details);
not broadcast unsolicited personal views on non-University related matters (see the Media Policy, Social Media and Public Commentary Policy and the Code of Conduct for more detail).

(5) University email and internet resources must not be used:

for any private commercial activity or external private work, except where the University has specifically granted exemption from this restriction in accordance with the External Work Policy. In these circumstances, use of Western Sydney University IT Resources should be kept to a minimum.
in a manner that constitutes unlawful discrimination, including vilification, or in a manner that intimidates, offends or humiliates any person contrary to the University's policies on harassment, vilification, discrimination and bullying. This includes language, imagery, and all other forms of communication. Refer to the Bullying Prevention Policy and the Discrimination, Harassment, Vilification and Victimisation Prevention Policy.

(6) Staff must use their University email address and provide their University identity when sending official University correspondence via email and must determine and abide by any additional record-keeping obligations that apply. [Ref. Spam Act 2003, section 6; State Records Act 1998, section 3]

(7) Official correspondence to students must be sent to students' University email addresses, although copies may also be sent to students' personal addresses [Ref. Spam Act 2003, Schedule 1, section 4].

(8) Automatic Redirection (or Automatic Forwarding) of University staff or corporate emails to an external/personal email address or to another email client is not permitted.

Personal Use of University Email and Internet

(9) The University Permits incidental personal use of University email and internet on the proviso that such use is legal, consistent with all relevant University policies and does not interfere with or conflict with University business. Authorised Users should note that:

University email resources are the property of the University and may be accessed in accordance with the
procedures authorised by the Workplace Surveillance Policy. Even personal emails sent from University
addresses or with University resources remain subject to the provisions of the Email and Internet Policy and
as such are property of the University ; and
University email and internet usage is logged at all times for reasons of security and to ensure system validity,
integrity and confidentiality, and may be restricted without warning if a University Digital Service is breached,
or if the CIDO (or nominee) believes there is the potential for a breach.

(10) While the University allows reasonable personal use of its email system, use of the email system for all personal
email is not authorised. Authorised Users are strongly advised to use other email providers if they have concerns
about personal information or private content being accessible in the University's systems. Organising email folders so
that personal email is not interspersed with University related email would also help to protect privacy.

Official Email — Related to Work or Study

(11) Emails dealing with University business are University records. As such, staff are obliged to ensure these emails are placed on formal University files (such as TRIM), preventing the need for access to the Authorised User's email account. Staff who will be absent from the University must ensure that information held in their email accounts that is relevant and necessary to conducting the University's business is accessible to those having a need for it. Refer to the Records and Archive Management Policy for further information.

Verification of Student Emails

(12) Occasionally, the University's ITDS staff receives requests from staff seeking verification that an email has been sent or received by a nominated University student email address. Such requests should be requested through the IT Service Desk, and include the information necessary to enable the transaction to be traced.

(13) In these cases the CIDO (or nominee) will normally advise whether the email described was sent or received by a nominated University student email address at the date and time indicated.

Part B - Security of Internet Access and the Email System

(14) Current email transportation methods cannot be regarded as secure. Email forgery and phishing can and does occur, and Spam email will occasionally appear legitimate enough not to be identified by the University’s spam detection controls automatic filtering. To prevent the misuse of email, Authorised Users should:

verify the authenticity of emails that suggest an unusual course of action;
verify the authenticity of email attachments to unexpected or unanticipated emails before opening them;
be cautious when using emails to communicate sensitive personal, commercial or other information;
use their own passwords, their own email accounts, and not permit others to use them;
not look at other Authorised Users' emails without their consent;
be aware that by sending messages to open groups their email addresses will become public, and could be misused; and
be aware that a forwarded message's contents can be changed from the original

(15) Just as email is a potential vector for spreading malicious code or conducting crime, the internet can and does get used in this way, and should not ever be considered entirely safe or secure. The steps Authorised Users should take to make sure there is not any misuse of the University's Internet Resources include:

not putting any sensitive or personal information, including your Credentials or parts thereof, into a website that seems suspicious;
not clicking on advertisements;
not downloading files or software that appear suspicious;
not opening downloaded files that appear suspicious (too large or small, the wrong name or file type), and instead reporting the file to the IT Service Desk;
ensuring activities taking place are abiding by the University's Code of Conduct, Student Code of Conduct and the Acceptable Use of Digital Services Policy; and
not obtaining software without appropriate review and approval.

Reviewing Performance of University Email and Internet

(16) The University takes steps to safeguard its Authorised Users and its email and internet resources by logging email and internet activity, running virus scans, placing firewall blocks around its Information Systems, and retaining logs and backups of all of the above. Staff authorised by the CIDO may access these logs for the purposes of analysis and examination; as required by law; for ensuring the confidentiality, integrity, and availability of the University Information Systems; or as directed in the Workplace Surveillance Policy.

(17) In order to efficiently manage the University Email and Internet Services, the University reviews performance and retains logs, backups and archives related to these services. Only staff approved by the CIDO may examine such records, and only for the purposes of this policy, as required by law or for ensuring the confidentiality, integrity and availability of the University Information Systems, or as directed in the Workplace Surveillance Policy or the Student Misconduct Rule.

(18) As part of reviewing and maintaining the system the University may limit:

the size of individual emails sent using University Email Resources,
the total volume of email sent using University Email Resources,
the amount of email retained on University Email Resources, and
the type of content sent or received using University Email and Internet Resources.

(19) The University may block emails that are determined by the University and/or its security systems to:

contain attachments of a type that can carry malicious computer code [Ref. ACSC Essential 8],
possibly be spam,
possibly contain malicious computer code, and/or
contains demeaning or threatening language, or
is contrary to University policy. [Ref. ISO 27002 section 13.2.1].

(20) Users should not use University email resources in a manner that could reasonably be expected to directly or indirectly cause excessive strain on any part of the University Information System, or unwarranted or unsolicited interference with other use of the University Information System. This would include use that consumes a large amount of bandwidth (e.g. through the use of large attachments) or the distribution of screen savers, games, spam or the like. [Ref. ISO 27002 section 7.2].

Part C - Mailing Lists

(21) The University provides directories of email addresses ("University Email List"). These are important to our ongoing work and their integrity and usefulness must be preserved. There are three types of mailing list:

A General Email List may be established for all, or a defined sub-set, of the University population. Membership of the list is mandatory for members of the University population who fall within the defined membership of the list. It does not include lists established by Schools or Units for communications to their own staff.
School, Division or Department Email Lists may be established by any unit for communications to its own staff.
Special Interest Email Lists may be requested by any Authorised User for the recurrent dissemination of information relating to the functions of the University to the subscribers. Membership of such lists is voluntary.

(22) All University emails sent via University Email Lists are subject to the following:

the content of emails sent using the University Email Lists must relate to the business of the University or further the vision, mission or goals of the University.
staff must not provide external people or organisations with copies of University Email Lists content or members listings.
the transmission of unsolicited email should only occur where the recipient can be identified as having a high probability of having a particular interest in the subject matter. If a recipient indicates that they do not wish to receive further messages on a topic, or from an individual or group, no further messages should be sent unless the message is sent as part of a General Mailing List.
The List owners are the CIDO (or nominee) for a General List, the Unit Head for a Unit List, or the Owner for a Special Interest List.
List owners are required to maintain up-to-date list information, including the addresses of all subscribers, any identification that is requested and provided, and conduct periodic reviews of membership and remove any addresses that are no longer current (for example, when staff or students have left the University).

(23) General email lists:

can only be established with the permission of the CIDO.
will be moderated by a person approved by the CIDO.
members can only unsubscribe from the list with the permission of the moderator.
only emails that are approved by the moderator or the CIDO may be sent via a General email list.

(24) School, Division, or Department email lists:

can only be established with the permission of the Unit Head or their delegate.
will be managed by a person approved by the Unit Head or their delegate.
Members can only unsubscribe from the list with the permission of the Unit Head.

(25) Special interest email lists are subject to the following:

no person may be included in the list unless they have subscribed to it. This does not prevent the use of a list to send an unsolicited email containing an invitation to join the list to one or more people provided that the email clearly states that the person will receive no further emails unless they elect to join the list.
subscribers have the right to unsubscribe at will.
only subscribers to the list, or a person who has been authorised by the CIDO, can send emails via the list. This does not prevent a person asking a subscriber to the list to send an email on their behalf; however, the subscriber is responsible for ensuring that any such email complies with these Procedures and all other relevant University policies.
the List Owner must provide a list of the subscribers to the CIDO when requested to do so unless this would reveal sensitive personal information (as defined in the Privacy Policy and the Privacy and Personal Information Protection Act, 1998) about a subscriber.
list Owners must remove a subscriber from the list where the subscriber has used the list in a manner contrary to law or the University's policies.
list Owners must create a meaningful list title

Part D - Commercial Emails

(26) From time to time University staff may engage in the sending of commercial emails that offer goods or services from the University. The definition of what constitutes commercial email for the purposes of this document is contained in the definitions (Section 2), and is otherwise defined within section 6 of the Spam Act. All Commercial Emails are governed by the Spam Act.

(27) A Commercial Email must contain:

the University's name, logo and contact details, or
the email author's name and contact details; and
a statement to the effect that the recipient may use an electronic address specified in the email to send an unsubscribe message.

(28) Staff sending Commercial Emails must ensure that the unsubscribe facility specified in the email is functional and requests are acted upon.

(29) Commercial Email must not be sent to a person who has submitted an unsubscribe request.

(30) University staff must not use email address harvesting software or an email address list that has been produced using such software. For this reason, care must be taken when using email lists provided by sources outside the University.

Part E - Formats and Encryption

(31) Attachments must be in a format that can be read by a readily available program for which the University holds a license in order to ensure that they can be read in the future. This means that attachments that are documents (not including spreadsheets, databases and the like) should be in ASCII, TXT, RTF, DOC or PDF format.

(32) Official Emails must only be encrypted and sent using software approved by the CIDO.

Part F - Webpage Blacklisting

(33) ITDS maintains a register of 'blacklisted', or blocked, websites that University systems will not allow Authorised Users to navigate to or load. Authorised Users of University Internet Resources should not attempt to circumvent the blacklist without consent from the CIDO and assistance from ITDS staff (see the Cyber Security Policy for more information).

Part G - Digital Signatures

(34) By law, digital signatures can have the same legal status as written signatures. Staff must not use digital signatures on either email or as part of online forms in place of written signatures without authorisation from the CIDO.

Part H - Backup and Archiving

(35) Emails, including emails of a private or personal nature, are regularly backed up and/or archived by the University [Ref. ACSC Essential 8]. It is not feasible to separate private or personal email from this process. Nothing in this procedure document prevents such backups or archiving. Requests for copies of backed up or archived emails will be treated in the same way as requests for copies of the original email.

(36) ITDS is not obliged to provide an Authorised User with copies of personal emails that it has backed up or archived.

Part I - Tagging of Unconfirmed Spam Email

(37) The University makes use of systems to automatically detect spam email. In the event these systems are unable to determine if an email is spam or genuine, it adds a “[SPAM]” tag to the front of the subject line and delivers it to the intended recipient. This may result in Authorised Users receiving spam email from time to time. Report spam emails to the IT Service Desk (itservicedesk@westernsydney.edu.au). Refer to ServiceNow Knowledge Article 0011503 for more details.

Part J - Other Applicable Guidelines for Authorised Users

(38) The Policy on Allowed Access to AARNet provides guidelines on allowable access and conditions of access to Internet services. Any Authorised User of University Internet Resources is expected to follow it.

(39) Eduroam users: Eduroam users access University Internet Resources through a separate wireless Network, set up to cater exclusively to the standards for connectivity outlined in Eduroam's Compliance Statement. Through the Eduroam wireless network, Eduroam users are granted access to University Internet Resources. However, a University email account is not generated for these users. Eduroam users are expected to comply with this procedure document as far as it applies to them, such as reasonable and courteous internet usage, as well as any applicable University Policies, such as the Acceptable Use of IT Resources and Email and Internet Policy.

Top of Page

Section 5 - Guidelines

(40) See the Email and Internet Guide document.

(41) This procedure makes reference to the International Standard for Information Security, AS/NZS ISO/IEC 27002, which can be accessed under "Standards On-line Premium (SAI Global)" via the alphabetical listing in the e-Resources section of the University Library.

Top of Page

Section 6 - Reference Documents

(42) The following University policies are referenced in this procedure:

(43) The following legislation, framework, or standards are referenced in this procedure:

Spam Act
State Records Act
Privacy and Personal Information Protection Act 1998
AARNet access
eduroam Compliance
Essential 8 Controls explanation