SALISBURY — The Salisbury City Council is moving forward this week with creating a new Internet use policy as well as a more specific policy to address the addition of a Virtual Private Network (VPN) to the city.
For roughly a decade, Salisbury has operated without an Internet use policy because it was not responsible for its own connection.
“Up until recently the city was using the county Internet connection,” said Salisbury Director of Information Technology Bill Garrett.
By branching out on its own, Garrett told the council it would be much easier for them to “self-govern” Internet use. It would also allow Salisbury to modernize how it treats the Internet.
“The existing policy is almost 10 years old,” said Garrett.
The proposed policy that he has given to the council is extensive. At seven pages long, it covers everything from off-duty employee Internet use to how the city firewall will deem certain sites appropriate or inappropriate. The council was unanimous in agreeing that a new policy is needed, but some members weren’t completely sold on adopting Garrett’s plan without revisions.
“I understand the need for a policy but, as I read through this, it did raise a lot of questions,” said Councilwoman Debbie Campbell.
She called Garrett’s policy a “good first draft” but one that still needs “much more consideration.” Campbell expressed some concerns over how the policy will handle employee Internet use while they are off-duty. Specifically, she had questions about Salisbury’s ability to regulate what employees post during their own time if it has a negative effect on the city.
Councilwoman Laura Mitchell had similar questions, such as if an employee is off-duty but represents themselves as an employee of Salisbury online, what actions, if any, can the city regulate?
City Attorney Mark Tilghman explained that “courts control the line.” But as far as planning for external regulation in a use policy, he admitted that it can be difficult for a city. As an example, he gave a scenario where an employee is found posting to hate websites while using their official job title or sending threatening emails during their own time. Because they are an employee of Salisbury, even if they aren’t using a city computer, backlash could be expected.
“I think the answer is yes, you can regulate it,” he said, adding that to what degree Salisbury can regulate what an employee puts on the Internet on their own time is always subjective and, again, individual cases can always end up in court.
Mitchell stressed that whatever the city does it has to be careful not to impugn on employee’s rights to free speech. Garrett told the council that the proposed policy should cover the city as well as can be expected. He explained that it is a “Frankenstein hybrid” that was put together by observing the Internet use policies held by municipalities similar to Salisbury and thus has standard language regarding off-duty Internet policies.
Still on the topic of the Internet, Garrett also put forth a use policy for a Salisbury VPN, which allows for authorized users on computers outside of the regular network to access files and information from the city database. This would allow employees to get work done even when they couldn’t reach the office, something that Garrett pointed out is practical in everyday use and even more so during emergency events such as the recent hurricane.
“You’ll have access to everything as if you were here in the building,” he said.
Such a network, if installed, will be new territory for Salisbury.
“The city has never had a VPN connection before,” Garrett told the council.
While there are many benefits to remote access, he admitted that the silver cloud does have a dark lining.
“With this connection, it provides inherent security risks,” said Garrett.
By giving employees access to sensitive information on their personal devices, there is always a chance that the device might be lost, stolen or hacked. Campbell suggested that the council might want to restrict what types of files can be downloaded through VPN.
However, attempting to put in a lot of limitations and conditions would likely cause a “headache” for the city, in Garrett’s opinion. He also noted that even viewing a file remotely technically counted as downloading it onto a new device since a copy is being made on the new hard drive.
“When you double-click to open that [file], you’re actually pulling a copy of that,” he said.
Mitchell agreed with Garrett that trying to load a VPN use policy with restrictions could result in a tangle. She pointed out that only trusted employees will be able to reach sensitive information through the VPN and that the council needs to trust their judgment. One thing that she did suggest is that anyone accessing the VPN be instructed to only do so from a private, password protected device.
Garrett agreed that “the more security you have the better.” Both the VPN and Internet use policies will appear before the council again for legislative discussion later this month.