DRAFT

U.S. Department of Housing and. Urban Development

ELECTRONIC MAIL POLICY

1-0. PURPOSE

The purpose of this Policy is to ensure that all users of the Department of Housing and Urban Development's (HUD's) electronic mail (e-mail) system are aware of the Department's policies on the appropriate use of e-mail at HUD. It is also intended to inform the end user of procedures that should be followed to ensure consistent availability, efficient performance and secure access of the Department's e-mail system.

The Office of the Chief Information Office/lnformation Technology Operations (OLIO/ITO) has installed an electronic mail system that is connected to all of the Department's Local Area Networks (LANs), both in Headquarters. and it's field offices, to satisfy the messaging and workflow collaboration, requirements of the Department. This system allows users to conduct government-related business by exchanging electronic communications, that may include business-related file attachments, to improve customer service and to reduce or replace conventional paper exchanges.

Electronic mail is an integral part of doing business in HUD, enabling more rapid delivery of vital programs, services and information. Increasing dependence on and use of e-mail results in a compelling need to protect these critical resources through constant and improved monitoring, administration, user training and awareness.

1-1. Scope

The policies and procedures contained within this document apply to all HUD program offices and their employees. These policies & procedures also apply to all other persons, including contractor personnel, who are granted the use of HUD's electronic mail system, regardless of where these persons are located.

2-0 POLICIES

This section contains policies related to the use of the Department's e-mail system. Specific procedures and practices that implement the policies are published in Section 3-0 of this document and are available on the Departmental Intranet. Since these procedures and practices are specific to the standard version of e-mail in operation at a given time, users should check HUD's Intranet regularly for the most current information.

Unless otherwise indicated, these policies apply to all electronic mail messages, including attachments, exchanged both within HUD and between HUD staff and the public.

2-1. Authorized Use

HUD's e-mail system is intended to conduct government business. Use of the e-mail system should be in conformance with HUD policies herein and in Chapter 8 of HUD Handbook 2400.1, REV 1, CHG 2, regarding Policy on 'Limited Personal Use" of Government Office Equipment Including Information Technology, including any related guidance on the use of government equipment for personal purposes. Users of this system are responsible for adhering to these policies and guidelines. All e-mail messages, including any file attachments, are the property of HUD.

2-2. Unauthorized Use

The following uses of the Department’s e-mail system are unauthorized:

• E-mail messages or file attachments sent for the purpose of conducting any illegal activities, either for- or not-for-profit, including making and/or aiding in carrying out threats against persons or Federal property.
• Electronic mail messages or file attachments that contain any profane, obscene, sexist or racist materials or other materials that could be considered offensive.
• E-mail messages that contain any language, information or file attachments that, in any manner, solicit or imply solicitation of any product or procedure or that may result in personal gain or profit for the sender and/or any of the addressees.
• Invitations, announcements or solicitations relative to special greetings, such as birthdays, personal editorials, commentary, memorials, poetry and religious philosophy sent to multiple mailing lists or that contain large file attachments that result in degradation in telecommunications traffic or that result in degraded performance of the overall e-mail system.
• Scripts or agents that result in the automated transfer of a user’s e-mail from the HUD e-mail system to a personal account, except as described in Section 203G below. Such agents or scripts can easily overload HUD’s e-mail system, especially when written incorrectly. These include agents that are used to transfer e-mail to private accounts outside of the HUD environment without authorization from headquarters OCIO/ITO and without successful testing and/or quality assurance.
• Transmission of encrypted messages.
• Mass mailings sent to multiple mailing lists throughout the Department using the Notes Name and Address Book, except as required in Section 2-5D.
• Propagation of chain letters or broadcasts of inappropriate messages, as identified above and/or in Chapter 8 of HUD handbook 2400.1, REV-1, CHG2, to lists or individuals or by way of other comparable resource-intensive addressing mechanisms.
• Subscriptions to external newsgroups, bulleting boards or other public forums, except for those that are deemed to be required to complete government-related business and that do not result in the receipt of large volumes of messages or very large messages or file attachments.
• Matters directed toward any unauthorized fundraising, lobbying or partisan political activities.

Unauthorized use of the Department’s electronic mail system by any of the above means may result in immediate suspension of the originator from the Department’s mail system and may result in further corrective measures. Said suspension from the e-mail system will remain until such time as the user’s immediate HUD supervisor confirms, in writing, to the appropriate Office of Information technology manager that he or she is, in fact, the user’s immediate HUD supervisor and verifies that he/she has discussed the circumstances of the vent with the user and provided direction and instruction on the proper use of the Department’s e-mail system. At such time, the user’s immediate HUD supervisor may authorize the reinstatement of the user’s e-mail privileges. Repeated offenses by a user may result in loss of use or limitations on the use of equipment or systems, disciplinary or adverse actions, criminal penalties and/or users being held financially liable for the cost resulting from damages due to improper use.

2-3. Electronic Mail Database Management

2-3 A. Message Retention Limits

In order to make sure that the electronic mail system operates as efficiently as possible, Headquarters' OCIO/ITO will perform periodic maintenance on all mail databases and servers. Part of this maintenance involves keeping the size of each user's mail database at a manageable level for both the user and the server on which it resides.

Headquarters' OCIO/ITO will establish specific automated and scheduled procedures for regularly purging the production mail system of 'out-dated" mail documents. Outdated mail is defined as messages older than 90 days in a user's inbox or folders (except for any folders or views that have been deemed to be exempt, such as the 'Meetings" and "Drafts' views). Such purges will be implemented on the Department's mail system, nationwide. Users will be provided with adequate advance notice prior to any scheduled automatic purge of messages.

Users should contact their Office Technology Coordinator (OTC) in Headquarters or their IT staff in the field offices for more information on document and e-mail retention procedures relative to regular archival and deletion of outdated e-mail documents.

2-3 B. Record Retention Responsibilities

The Courts and the National Archive and Records Administration (NARA) have advised agencies that whenever official record material appears on electronic mail systems of any kind, agencies are obliged to retain that material just as they are any official record.

An official record is any, documentary material, regardless of physical form, that is made or received by HUD in connection with the transaction of public business, and appropriate for preservation by HUD, or its legitimate successor, as evidence of the organization, functions, polices, decision, procedures, operations or because of the value of the information they contain (44.U.S.C. 3301).

Until a unified electronic retention policy is established by the Office of Administrative and Management Services (OAMS), to comply with this policy of retaining official record material, HUD electronic mail users must do the following:

a. Originators of electronic mail messages are responsible for determining the record value of any transmission which they originate. A transmission has record value if it is the only place which transmits information fitting the definition of 'official record' as stated above.

b. Once the originator has determined that a transmission is record material, he/she must retain a hard copy of the message for reference. This hand copy must contain all transmission data (time, date, all addressees and subject line).

c. The printed copy must then be filed and maintained with records of a similar nature for the period required by the records schedule for those records. For more specific information on retention periods, see HUD Handbook 2225.6 for HUD specific records schedules related to each HUD program area and HUD Handbook 2228.2 for General Records Schedules applicable to all government agencies.

d. For questions regarding the records retention policy, contact OAMS.

2-3C. Mailbox Size Limitation

Users must be aware and understand that storage space is not an infinite commodity and that the Departments electronic mail system is not a document-retention system. It, therefore, cannot be expected to retain every message for an indefinite period of time. Thus, the OCIO/ITO has established maximum size limits on a user's mail database. The current limits for the existing standard electronic mail database is 100 megabytes. These database size limits are subject to modification to address emergency storage situations on the servers. Users should periodically check HUD's Intranet for current information on mailbox size limitations within HUD's e-mail system.

2-3 D. Message Size Limitations

It is necessary to limit the total size of individual e-mail messages that are sent through the Departments' electronic mail system in order to ensure that all e-mail messages are transmitted in a timely manner and that the e-mail system is not over-burdened. The current message size limitation is 5 megabytes for both incoming and outgoing Notes Mail and Internet messages, including attachments. This message size limitation applies to all users in Headquarters and the field offices. Message size limits are subject to modification to address emergency situations or storage needs on the servers. Users should periodically check HUD's intranet for current information on message size limitations on the Departments electronic mail system.

2-3 E. Mail Files (User IDs)

The standard naming convention for HUD's electronic mail system is first name, middle initial, last name. Every effort will be made to standardize user names across computer systems. Whenever possible, the name used for the electronic mail system will be the same as the name used for payroll systems to ensure that all employees receive approved mass organizational mailings.

It is also HUD policy that each user will have only one mailbox. Thus, all incoming mail, whether sent using the Departments internal mail system or through the Internet, will be delivered to the user's HUD central internal e-mail database.

2-3F. File Attachments

In accordance with periodic security reviews and enhancements within HUD's network and in keeping with industry standards on virus protection and detection, attachments with certain file extensions (currently.exe, vbs, and pif file types) will be rejected via HUD's electronic mail system, including Internet mail transmissions. Users should periodically check HUD's Intranet for a current list of unauthorized file extensions.

2-3 G. Forwarding MAIL

Forwarding of HUD mail to personal accounts is only supported when it is not practical to use HUD-issued equipment and procedures to access mail from a remote location (e.g., travel outside the Country, issuance of HUD equipment is unavoidably delayed). In such cases, temporary mail forwarding will be executed and terminated by the Notes administrative staff.

Except as noted above, agents that automatically redirect a user's HUD mail to personal or other outside accounts are not supported and, in fact, such agents will be disabled.

2-4. Data Security Considerations

To protect HUD's data from unwanted access, the e-mail software and HUD's security policy require every user to have an individual password. It is the responsibility of all HUD employees to implement reasonable measures to protect this password. It is a violation of HUD's IT security policies to share this password with others except in an emergency situation. In addition, any batch files that access an electronic mailbox must not have the password embedded in the file.

Users are reminded that regardless of password control measures, all e-mail messages and resulting attachments are the property of the Department. Management has the same rights to inspect e-mail as they do with hard copy documents. Direct line supervisors, managers, or the Inspector General can submit a written request to either the designated IT Electronic Mail Project Leader in Headquarters or to the appropriate IT staff in the field offices to access an employee's e-mail messages. Such requests can he fulfilled without notification to the affected employee.

2-5. Addressing Multiple Users

2-5 A. Public Mailing Lists

A public mailing list, or group, may be used to address authorized messages to a specific group of users when the group is not addressable by the Department's broadcast mailing system (see 2-5-C. below). This situation generally occurs when a group contains specific personnel in multiple program areas, divisions, or branches. Public mailing lists reside in the HUD Name and Address Book (HUD NAB) and can only be created by the e-mail Administrator. Owners of public mailing lists are expected to use this resource judiciously and in accordance with Sections 2-1 and 2-2 above. In addition, owners of public mailing lists are responsible for initiating action to keep the lists current.

2-5B. Private Mailing Lists

Users can create private mailing lists, or groups, for their own personal use in their Personal Name and Address Book (Personal NAB). A private mailing list resides on the hard drive of the user's workstation who creates it and is accessible only by that user. The e-mail administrator cannot create or modify personal mailing lists. Users should use personal mailing lists largely for maintaining Internet addresses of business or personal contacts. Adding HUD employee, names to a user's Personal Address Book can result in addressing conflicts with the HUD Name and Address Book.

2-5 C. Broadcast E-Mail Messages

Broadcast e-mail messages are those that are sent to all HUD employees or program area subsets by senior level management. Broadcast e-mail messages are generally sent to ensure all appropriate employees are aware of HUD sponsored, business-related or mandatory events. Whenever possible, HUD's Intranet should be used in place of broadcast e-mail messages.

Assistance and authorization from Headquarters' OCIO/ITO is required to transmit broadcast e-mail messages. A minimum of 24 hours notices must be given in order to accomplish the mailing as required. Broadcast messages that are sent to all HUD employees or groups of HUD employees will be kept brief and in compliance with Sections 2-1 and 2-2 above. Broadcast messages should contain limited text and whenever possible include the appropriate URL linking to more detailed information on HUD's Intranet no special font settings or graphics should be included in the e-mail broadcast message. The Departments network resources are not to be abused or overburdened by duplicating text in e-mail messages that already resides on or that is more appropriate to be displayed on HUD's Intranet.

The local IT staff must authorize broadcast messages generated by field office users. Field office users should contact their local IT staff for assistance with developing and transmitting such messages.

2-6. Removing Separated Employees

Separating employees must follow established procedures for completing a Form HUD-58, Clearance for Separation of Employees as part of their clearance process. Through this process, information is provided to the e-mail administration staff sufficient to remove the separating employee's e-mail access and account in the event that a supervisor needs access to a separated employee's mail, that supervisor must follow locally established procedures for requesting a file restoration.

2-7. Mail Communication Outside of HUD

Whenever feasible, external organizations should use Internet mail to exchange electronic mail with HUD personnel. In the event that Internet mail does not meet the communication requirements, the appropriate HUD manager should contact their OTC in Headquarters or their appropriate IT staff in the field offices to request an alternative form of communication. Specific details outlining the alternative method requested and an appropriate justification as to why the current standards do not meet the requirements sought must be provided. Action will be taken to meet the communications requirements as HUD technology, infrastructure and security standards allow.

As with all mail sent over HUD's electronic mail system, staff should limit the use of Internet mail to business related communications. Users should also be aware that Internet mail travels over public networks and users should, therefore, assume that any e-mail messages they send via the Internet can be read by others. Therefore, users should exercise appropriate caution and professionalism when sending e-mail messages via the Internet.

2-8. Generic Mailboxes

Generically named mailboxes are designed to provide program areas with a mailbox that is specific to a particular program area objective rather than specific to a user. These mailboxes provide a central repository that can be accessed by all members of a specific functional area, and provide a central mailing address to that area's customers.

Generically named mailboxes will be established if there is a demonstrable need. Each generic mailbox must have an “owner" identified with an e-mail address and phone number. The owner of the generic mailbox is required to routinely purge the generic mailbox of unnecessary and outdated messages. Generic mailboxes are subject to all policies and procedures stated throughout this Electronic Mail Policy including user maintenance, message size limitations and message integrity. Generically named mailboxes will be deactivated if the mailbox is not maintained in compliance with established policies and procedures.

Users should coordinate with their OTC in Headquarters or their local IT staff in the field offices to submit a request for a generic mailbox

2-9. Remote Access

The ability to remotely access mail accounts is supported by the Department for authorized users. Remote access capability must be authorized by the user's immediate HUD supervisor. The appropriate OTC in Headquarters or the local IT staff in the field office is responsible for coordinating requests for remote access to the Departments electronic mail system.

3-0. ELECTRONIC MAIL PROCEDURES

3-1.Message Archives

Users are responsible for deleting all messages for which they no longer have a need to retain. Users should expect that messages that are 90 days old or older will automatically be purged from the production mail servers as part of HUD's regularly scheduled and automated e-mail and work maintenance procedures These purged messages will be relocated to a long-term, storage device accessible to users.

3-2. Mail Forwarding

Headquarters and field office users must submit a request with appropriate justification to their OTC or local IT staff, respectively, to forward their mail to a personal or other e-mail address outside of HUD. The request must include a start and end date and the exact address to which the mail is to be forwarded. Upon approval, the Notes administrative staff will initiate and terminate the mail forwarding.

3-3.Public Mailing Lists

To request a new public mailing list or a change to an existing public mailing list, the procedures

below will be followed:

• Field office personnel

o Follow locally established procedures in the field offices.

· Headquarters personnel

o Submit requests to the OTC in each program office

o In writing, identify the exact title of the mailing list to be created or modified

o In writing, identify the full name(s), including middle initial where appropriate, of the users to be added or modified.

o In writing, identify the `owner" who will be required to authorize all requests for modifications.

The following procedures will be used to implement HUD's policy regarding mailing lists:

· Prior to sending a message to a public mailing list, users will check the member listing to ensure that the appropriate list is being used for the intended audience.

· Owners of public mailing lists, or a designate, will review their mailing lists on a quarterly basis to identify when the list is not current, and initiate appropriate changes following the procedure above.

· Except as required for Broadcast e-mail messages as described in Section 2-5 C., the Notes Name and Address Book will not be used for sending mass mailings throughout the Department

3-4.Private Mailing Lists

When a user receives or is moved to a new workstation, their appropriate e-mail files (Personal Name and address Book, e-mail ID and e-mail desktop) will also be transferred to their new workstation. These actions will be completed by their local IT Computer Specialist staff or, in Headquarters, IT staff or the users, as appropriate.

3-5. Broadcast E-mail Messages

Assistance and authorization from Headquarters' OCIO/ITO to broadcast e-mail messages should be coordinated as follows:

• The author of the proposed broadcast message will coordinate with the appropriate Office of Information Technology manager in order to finalize the message at least four hours prior to transmission.
• The following items will be specified in writing by the author to accomplish the broadcast messaging:
• Date & time message should be sent
• ID from whom the message should be sent
• Subject line text
• Message text
• The Notes administrative staff will not be responsible for the text of the message and, therefore no spell checking, of the message text will be done by the Notes Administrative staff.

3-6. E-Mail Database Size Limitations

Users will automatically receive an e:mail message notifying them that they are approaching the designated size limit on their e-mail database. At that time, users should contact their OTC in Headquarters or their local IT support staff in the field for assistance in reducing the size of their mail database. Such assistance may include instruction on deleting outdated and/or unnecessary e-mail documents or references to the existing URL link to the on-line instructions for archiving located on HUD's Intranet.

3-7. Relocation of Staff

When HUD staff move from one HUD office to another or from one program area to another within the same field office, they should notify their Office Technology Coordinator (OTC) in Headquarters, or, in the field, their local IT staff. Once notified, the appropriate IT official or OTC will submit a request for recertification for the user so that the user's e-mail address reflects his/her new location.

3-8. Password Resets

Headquarters employees who forget their electronic mail password should request a password reset from the Notes Administration staff or their OTC. Headquarters employees who are located off-site should call the IT Security Office for appropriate instructions. For security procedures, the off-site user's name and last six digits of their social security number will be required in order to authenticate the user. Coordination between the OCIO/ITO and IT Security staffs will be conducted in reissuing the user's Notes ID.

Field office employees who need their electronic mail passwords reset should contact their local IT staff or follow other local problem reporting procedures.