Educause Security Discussion mailing list archives
Re: Role of Campus Police. Was: number of IT security staff
From: John Lupton <lupton () ISC UPENN EDU>
Date: Fri, 4 Feb 2005 09:33:54 -0500
One of the things we stress most when talking to the campus community about what we (Penn Info Security) do is the concept that "we are *not* cops" - we view our function as much more along the lines of being consultants and liasions than disciplinarians and wrist-slappers. And, in most cases where it turns out some wrist-slapping is warranted, there is usually an appropriate body (e.g., Office of Student Conduct) to do the slapping. And, if it truly is criminal in nature, then it ends up with the campus police. (Penn's force, BTW, is fairly large and fully accredited, including a detective division). Another thing we try to stress to the campus community when a troubling incident or circumstance pops up and they ask us for advice and/or help (email harassment is probably the most common example) is that if they believe a crime has been committed or is about to be committed, or if they feel the personal safety of themselves or any other person is in jeopardy, they should contact the University police directly and immediately. We are more than willing to assist the campus police in any investigation they undertake, but we cannot, and should not, undertake a criminal investigation independently. There are times when the University's general counsel advises us to be careful about what records we supply, and under what circumstances, whether or not a court order is required for some things, etc., but for the most part, we have a pretty good working relationship with the campus police. Up until a year or so ago, one of the detectives was pretty well trained in IT security issues, and liked working with us, but he left the force when his wife got a good job somewhere else. On the whole, though, the campus police don't hesitate to call us in if there is some sort of IT skulduggery they have their hands in, and they seem to appreciate the help. Anyway, that's my story, and I'm sticking to it. ============================================== John T. Lupton Sr. Information Security Specialist Information Systems & Computing/Information Security University of Pennsylvania, Philadelphia PA USA lupton () isc upenn edu (215) 573-3811 On Jan 31, 2005, at 2:08 PM, Piscitello, Frank wrote:
Well, I have a different view of Police Vs. IT staff. I treat it similar to corporate security. If the incident is "civil" in nature, then I handle it as an IT incident. If it seems that it is more criminal or the case turns into criminal, I contact law enforcement. The campus police can handle some incidents (I usually help with suggestions). However, I also have contact with the State Police. For example, if I am going over a hard-drive for campus policy violations, and I find a file full of credit card number, names, and birthdates. This would lean me to a criminal issue, and I would forward all my information to Law Enforcement. I use the same hardware/software to aquire hard drive evidence, so it makes it real easy to transfer the information. Remember, there are things that we can do as "civilians" for policy enforcement that police can't do without warrants and support from the local DA's office. However, once the case is turned over to Law Enforcement, you become an agent for them so, you have to follow the same rules as law enforcement for the remainder of the case. So, word of advise: Get to know your law enforcement. Get names and contact information. Talk to them on how they handle evidence, and where to draw the line at transferring the case to them. -Frank ------------------------------------------------------------------ Frank J. Piscitello, Jr. Information Security Manager Office of Information Security West Chester University of PA http://www.wcupa.edu/infoservices/security/ Security is everyone's responsibility. ********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
Current thread:
- Re: Role of Campus Police. Was: number of IT security staff, (continued)
- Re: Role of Campus Police. Was: number of IT security staff Tracy Mitrano (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Steven Alexander (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Penn, Blake (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Brian Kaye (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Jon E. Mitchiner (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Penn, Blake (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Alec Yasinsac (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff James Riden (Jan 31)
- Re: Role of Campus Police. Was: number of IT security staff Rodney Petersen (Feb 01)
- Re: Role of Campus Police. Was: number of IT security staff Georgia T. Killcrece (Feb 02)
- Re: Role of Campus Police. Was: number of IT security staff John Lupton (Feb 04)
- Re: Role of Campus Police. Was: number of IT security staff Kay Sommers (Feb 04)