Audience:  Building Techs

System Preference:  NA

Occasionally we will be approached to investigate what someone is or has been doing on their BCSC-issued device or the BCSC network.  Our response will follow one of two tracks depending on whether the person being investigated is a student or staff member.  However, in both cases the process is set up to ensure we have the appropriate authorization, leadership is notified before we start, that we have adequate information to do an effective investigation, and that potentially sensitive material (nudity, pornography, etc) is handled on an 'only those that need to be involved' basis.

Process:

1. You are asked to investigate someone's tech activity.
2. Is the person to be investigated:
   • a staff member?  If yes, inform the requester to go to their supervisor with the request.  The supervisor must then contact the Assistant Superintendent of HR requesting the investigation.  The Assistant Superintendent will provide authorization to the Director of Technology.  You will not be involved any further in the investigation.
   • a student?  If yes, inform the requestor to go to their building leadership or their designee (ex. high school dean) with the request.  
3. The building leader or their designee enters a work order.
4. Collect and record on the work order as many of the following details as possible:
   • Name and Username of the individual
   • ip address(es) of device(s) investigated
   • what is the individual alleged to have done or accessed
   • when did the behavior occur or was observed
   • what applications or sites might have been involved
   • name of other individuals involved.​
      
5. Determine if the incident is discipline related (games, VPN, movies, etc) or legal issue related (substance abuse, pornography, violence, etc).
   • If discipline related, work with the principal to search student's browsing history. The result of the investigation may include recommendation to delete content or block content. Refer to the District Tech Specialists if you have any questions.
      
   • If legal issue related, reassign the request to the District Tech Team during work hours or Network Administrators outside of work hours. 
     • The investigating team will cut the student's access, log timeline and information, take screenshots as appropriate.
     • The investigating team will notify the SROs, Principals, Assistant Tech Director and Tech Director. 
     • The recommendation to Principal will determine if a new account is appropriate and create that account. Recommendation to the SRO will determine if the findings need to be escalated (if related to cybercrime, dark web).