Policies and Guidelines on the Use and Maintenance of the BIR E-Mail And Internet Browsing Facilities

March 22, 2000 REVENUE MEMORANDUM ORDER NO. 29-00 SUBJECT : Policies and Guidelines on the Use and Maintenance of the BIR E-Mail And Internet Browsing Facilities TO : All Concerned BIR Officials and Employees I. OBJECTIVES This Order prescribes specific policies and guidelines for the Bureau's Internet Facilities which includes: account administration/maintenance user accountability security II DEFINITION OF TERMS 1. INTERNET refers to the technology that allows a user to access other agencies and web sites and send/receive E-mail messages outside the Bureau. 2. USER refers to any BIR employee given access to the Bureau's E-mail Intranet and Internet facilities 3. USER ACCOUNT refers to an eight character user login assigned to an employee which shall be used in logging onto the system III POLICIES 1. ACCOUNT ADMINISTRATION/MAINTENANCE 1.1 E-mail/Internet Browsing 1.1.1 E-mail Use and access of E-mail account shall be but not limited to the following users: Automatic account creation for BIR Management (Commissioner of Internal Revenue (CIR), Deputy Commissioners (DCIRs), Assistant Commissioners (ACIRs), Head Revenue Executive Assistants (HREAs), Revenue Region (RR) Directors, Revenue District Officers (RDOs), Revenue Data Center (RDC) Heads Upon request personnel whose designations are other than those stated above. 1.1.2 Internet Browsing Use and access of Internet account shall be but not limited to the following users: BIR Management (CIR, DCIRs, ACIRs, RR Directors (for regions with network connection), RDC Heads) Bureau personnel involved in inter-agency projects such as FINLINK and those approved and identified by the DCIR-Information Systems Group (ISG). BIR Division Chiefs of offices with required on-line activities with other government agencies such as Statistics Division, Revenue Accounting Division and Systems Maintenance & Support Division. BIR Division Chiefs of offices with constant research activities such as the Training Division System Standards and Technology Management Division, Security Management Division, Quality Assurance Division Systems Support Division, and Systems Development Division. Except for BIR Management who are priority users of the Internet, issuance of Internet accounts to other users other than those stated above shall only be allowed upon approval (by the DCIR-ISG) of their Request Form (refer to Annex A for detailed procedure in filling-up the E-mail Account Request). 1.2 Disk Allocation In order to promote and maintain the effective use of E-mail resources of the Bureau in general, the system administrator shall limit the size of E-mail accounts to 2 MB. However, E-mail accounts which are exempted from the 2 MB quota are those of the following: Commissioner Deputy Commissioners Assistant Commissioners Revenue Data Center Heads Office and Project Accounts such as - bir-web - asm - edtqcy - helpdesk (hdeskno, hdeskmla, hdeskcb hdeskqc, hdeskmk) - rau - tincontrol - itad The E-mail server is not a long-term storage facility. Limitation of the size of individual E-mails would reduce the impact on the network. Those who wish to be exempted from this policy should submit a duly filled-up E-mail Account Request Form (tick portion for "Request to increase Disk Quota'') to the Chief of the Systems Support Division (SSD) of the Information Systems Operations Service (ISOS). 1.3 Archiving and clean-up of Old E-mail Users are encouraged to open/read mail as a daily business practice. E-mail has the potential to grow exponentially while the Bureau's E-mail server is limited both in terms of disk space and performance. The impact of unrestricted growth of the system would be: reduced E-mail server performance backup and recovery for the system would become unmanageable Dormant or inactive accounts for one (1) month shall be automatically deleted. Users availing leave of absence for one (1) month or more should notify in writing, SSD-ISOS so that their accounts will not be deleted. IEHSDA SSD-ISOS reserves the right to enforce, on behalf of the Bureau, a deletion/archiving in particular incidences, if the performance of the E-mail server is being affected by the volume of E-mail being stored and not archived. However, due notice of such impending action will be provided to the affected users. (refer to Annex B Confirmation Notice of E-mail Account Deletion) 2. USER ACCOUNTABILITY 2.1 Rules of Use 2.1.1 The Bureau's Internet facilities should only be used for the purpose for which they are authorized (i.e. transmission of official documents/information/research, etc.) 2.1.2 Users must use E-mail/Internet browsing accounts which have been authorized for their use only. 2.1.3 Users must not attempt unauthorized access of computer installations outside the Bureau using Bureau computers and networking facilities. 2.1.4 In view of the 2MB limit imposed on individual E-mail messages, users must use the FTP (File Transfer Protocol) server in sending files greater than 2 MB. (Refer to Annex C Office Automation Bulletin 1-2000 for detailed procedures on the use of the FTP server or call the Office Automation Unit of ISOS for immediate assistance). 2.1.5 Accessing of pornographic web sites and downloading pornographic materials using the BIR Internet facility is strictly prohibited. 2.1.6 All users are reminded that the E-mail facility should be used for the purpose of enhancing communication for activities that serve the interest of the Bureau. As such, sending of chain letters and other inappropriate materials using the E-mail facility is not allowed. TEcCHD 2.1.7 Downloading of evaluation software is prohibited unless with proper authorization (approved "Others" portion E-mail Account Request Form) duly noted by a higher Bureau official of the concerned service or group and approved by the DCIR-ISG. 2.1.8 Transmission and/or retrieval of any material/document/information in violation of any of the existing policies of the Bureau and the Philippine Government is strictly prohibited. Users must be guided by the set of policies stated herein. 2.2 Violations 2.2.2 Use of the Bureau's Internet facility without proper authority. 2.2.3 Illegal access to Internet facility using another user's existing account. 2.2.4 Opening one's mailbox without the owner's knowledge and/or consent. 2.2.5 Use of chat software (i.e. RCC, ICQ, Yahoo, etc.) 2.2.6 Replication of account 2.2.7 Unauthorized cascading of the proxy server. 2.2.8 Transmission of any material/document/information in violation of any of the existing policies of the Bureau of Internal Revenue, Department of Finance. and the Philippine Government Law is prohibited. This includes, but is not limited to the following: Confidential documents of the Bureau Unofficial Bureau information and/or documents Information that may give negative or destructive image to the Bureau and the Philippines Information which violates or infringes upon the rights of any other person Defamatory, inappropriate, abusive, obscene, profane, sexually oriented, threatening, racially offensive or illegal materials Gossips. rumors or anonymous messages 2.2.9 Any user who violates above stated Rules of Use shall be subjected to sanctions outlined below. 2.3 Sanctions Inappropriate, unauthorized use of the E-mail/Internet Browsing facility may result in the revocation of issued account plus the imposition of appropriate administrative sanction depending on the severity of the violation committed. 2.3.1 First Offense : Written stern warning shall be issued and shall form part of his/her 201 file. 2.3.2 Second Offense : Suspension of Account minimum of 10 days to a maximum of 4 weeks. Reactivation of account is possible provided that a formal approval of the DCIR-ISG is granted to the request of the relevant Division Chief and a user signed undertaking to abide by the rules of E-mail usage is required. Notification of suspension is forwarded to the user's Division Chief. Moreover, the unauthorized use or violation shall also be immediately reported to the Internal Security Division (ISD) for administrative investigation and filing of the appropriate Formal Charge(s) against personnel concerned, if evidence warrants. Accounts may be reinstated before the end of the standard suspension (provided approved by the DCIR-ISG) where either: The user presents information to the Chief of Security Management Division (SMD) of the Information Planning and Quality Service (IPQS) which indicates that he/she was not involved in the transgression of the Rules of Use. or: The Division Chief of the user requests that the account be reinstated for course related work only (e.g. completion of an assignment). In this case, the user is required to sign an undertaking to abide by the Rules of Use. 3. SECURITY 3.1 The BIR mail server and the net-proxy server. which serves as the central server which shall monitor the access of users to the Internet, shall be located at the server room of the Revenue Computer Center Building 3.2 The BIR mail server and the net-proxy server shall be jointly administered by an appointed system administrator(s) from the pool of system administrators at the National Office and of the Office Automation (OA) Unit Head. 3.3 Users should secure their login passwords in order to prevent illegal access of other users through their accounts. 3.4 All accounts, except that of the " Sysadm "(root), shall have a default of bin/false shell. 3.5 Current users of E-mail facilities shall not have a home directory on the mail server. 3.6 Changing/resetting of passwords shall only be allowed after verification of user's request for changing password. IV. GUIDELINES AND PROCEDURES 1. E-mail Account Creation 1.1 Users should submit a duly accomplished 'E-Mail Account Request Form' (Annex A ) to the SSD-ISOS for account creation. The accomplished form shall serve as the official file of the Bureau which, in effect, will make the requesting personnel accountable for any act of misuse of his/her account. 1.2 OA personnel from SSD-ISOS and RDCs shall configure user's PC at the National Office and computerized BIR Offices (RRs & RDOs) respectively, to enable him/her to access the E-mail facility. Same personnel shall provide the user with his/her temporary password. 2. Changing of Password 2.1 User should submit a duly accomplished E-Mail Account Request Form, indicating request to reset his/her password to the Chief, SSD-ISOS. 2.2 OA personnel of SSD-ISOS, upon receipt of request form, shall verify from the user his request for password resetting. 2.3 TELNET access to the mail server shall be opened once the request has been verified. 2.4 User can now change his/her password. User may request SSD or RDC personnel for coaching on how to use TELNET in resetting his/her password. The user shall be given thirty minutes to change his/her password. After the time has elapsed, TELNET access shall no longer be available. 3. Roles and Responsibilities 3.1 Deputy Commissioner of ISG approves the following: Request for Internet accounts Request for downloading of software from the Internet Lifting of account suspension Final approval for request for exemption from disk allocation unit of 2 MB 3.2 System Support Division (SSD-ISOS) performs the following: Chief, SSD-ISOS approves request for exemption from disk allocation limit of 2MB. Issuance of E-Mail Account Request Form (for password resetting/changing, update of E-mail account and request for E-mail account) Server and system administration - Maintenance of Office Automation servers (E-mail, proxy, web) - Granting, creation and maintenance of E-mail/Internet browsing accounts - Issuance of E-mail Account User Notification (refer to Annex D) upon creation of user account - Changing/resetting of passwords - Revocation of inactive accounts due to any of the following reasons: resignation, termination or retirement - Suspension of account as a result of sanction Internet architecture and design, PC reconfiguration and other technical efforts needed to run the Internet facility. Training/orientation of NO user(s) relative to use of E-mail facility All user account ([emailprotected]) should be used only by the Office Automation (OA) personnel from SSD-ISOS. 3.3 RDC Office Automation Section (RDC-OA) Issuance of E-mail account request Form to RRs & RDOs PC users Configuration (set-up of E-mail account) of PCs at the RRs & RDOs Training/orientation of district/regional personnel relative to use of E-mail facility 3.4 Security Management Division (SMD-IPQS) performs the following: Monitoring of user's compliance to Rules of Use. Investigate incident(s) of security-related events associated with the use of the Bureau's E-mail/Internet Browsing facilities. V. REPEALING CLAUSE All other revenue issuances and/or portion(s) thereof that are inconsistent herewith are hereby revoked and/or amended accordingly. VI. EFFECTIVITY This Order shall take effect immediately. CcTIDH (SGD.) DAKILA B. FONACIER Commissioner of Internal Revenue ANNEX A E-mail Account Request Form (BIR Form No . 0041) Purpose: The purpose of the E-mail Account Request Form is to request the System Support Division to grant E-mail account/Internet Browsing to designated bureau personnel. Initiated by: All Bureau Personnel Approved by: Head of Office/DCIR, Information System Group Form Sections: 1. User Information This section contains the following user information which is required for the processing of the request: acCETD a. User's Name (First, Last, M.I.) b. Site-Division/Section National Office (NO) Revenue Data Center (RDC) Regional Office (RO) Revenue District Office (RDO) c. Position/Title d. Signature e. Date Requested 2. System Access This section contains information on the type of system access being requested by the user. The user may mark one or more boxes with an 'X'. It contains the following fields: a. Re-setting of password if user wishes to change his/her password b. Update of E-mail Account if user transfers to another site which needs to change his/her E-mail account. c. Request for E-mail Account if user wishes to have an access to BIR mailserver d. Request to Increase Disk Quota/Reason This field contains description of the Reason of the request. This description will provide input for the approval or disapproval of request to Increase Disk Quota. e. Request for Internet Browsing/Reason This field contains description of the reason of the request. This description will provide input for the approval or disapproval of request for Internet browsing. f. Others This field contains a request such as downloading of software, etc. Note: Request for Items 6D, 6E or 6F needs approval from DCIR-ISG 3. Portion of Head of Office This section contains the recommending approval of the Head of Office. a. Date 4. Portion of Chief, SSD This section contains the recommending approval of the Chief, System Support Division. a. Date 5. Portion of DCIR, ISG This section contains the approval/disapproval of the DCIR. 6. Portion of System Administrator This section verifies that the System Administrator has properly processed the request. 7. Stamp of Receiving Office & Date of Receipt This section contains the stamp of the receiving office and the date of receipt. BIR FORM NO. 0041 E-mail/Internet Account Request