INTEGRITY IN PROTECTING WHAT POWERS US
"Protecting our company's assets isn't just about corporate policy or security, it's about accountability and respect for the resources that help us all succeed. Every action we take to safeguard our assets and data reinforces the trust our employees, customers, and suppliers place in us."
Jill Mulligan,
Chief Legal Officer
Cyber Security
Why It's Important
BNSF employees who have access to or use any BNSF technology resource that creates, processes or stores BNSF information, including computers, mobile devices, applications, networks, hardware, software and other related services and other electronic equipment (collectively "BNSF Systems") must help to ensure that BNSF Systems are not subject to damage, theft or unauthorized access.
It is also the employee's responsibility to notify bnsf | tech of any system being used and provide requested information about the system, its use and other relevant attributes. This allows bnsf | tech to catalogue, update and inspect BNSF Systems to minimize any security risk. Devices, user identification and credentials must be secure at all times and devices must be password protected when left unattended.
Any suspected incident of fraud or theft should be immediately reported for investigation.
INTEGRITY CHECK:
Is Something Phishy Going On?
Suppose you receive an unexpected email from a customer you have been working with on a project. The email asks you to validate some confidential BNSF pricing information and requires you to click a link in the email to do so. Do you click?
The Right Track
Never open an email attachment or click a link unless you are expecting the email and it’s from a known sender. If you think an email may be from a known contact, call them at their company using known contact information to confirm if the email is authentic.
Key Guiderails
Recognize Suspicious Communications
Attackers may send email from what appears to be a reputable email address, but the “from” address can easily be falsified. Fraudulent emails sent by social engineers are known as phishing attacks. Malicious websites frequently accompany phishing attacks to solicit personal, often financial, information. Do not rely on the “from” address as proof of authenticity. Attachments can contain executable malware, which can plant spyware on your computer without leaving any trace of its actions.
Generative AI
Why It's Important
Generative Artificial Intelligence (Generative AI) is a broad term used to describe technology that creates new content, such as text, data, or media, based on patterns and examples learned from existing data. BNSF supports technology as a strategic enabler as we enact our vision to provide transportation services that consistently meet our customers’ expectations, safely and efficiently. If used improperly, Generative AI can pose risks around confidentiality, privacy, and data security. We must ensure BNSF’s use of Generative AI, like all technology, is consistent with our Vision and Values and in compliance with the law.
BNSF employees are to prioritize data security and privacy in the development and use of Generative AI, employing security best practices to minimize potential for security vulnerabilities. Risks of Generative AI include:
- Improper Reliance
- Privacy Violations
- Copyright and Intellectual Property
- Security Risks
BNSF will balance fostering innovation while mitigating the potential risks associated with Generative AI. The following key principles apply to the development, procurement, and use of Generative AI at BNSF.
Key Principles for Responsible AI Use
- Human-centered Development and Use: AI is a tool to assist humans, not replace them. Employees must always have final oversight over content generated with AI assistance
- Integrity and Compliance: AI use must respect human rights, avoid discrimination, and comply with laws on privacy, intellectual property, and data protection
- Transparency and Accountability: Employees must understand how AI tools operate and take accountability for AI-assisted decisions
- Security and Resilience: AI tools must be secure, reliable, and resilient against vulnerabilities
- Copyright and Intellectual Property: AI use must respect ownership rights and avoid creating content that infringes on protected materials
Risk Mitigation and Bias Awareness
- Bias Detection: Be aware of potential biases in AI-generated content and take corrective measures
- Fact-Checking: Validate AI outputs against trusted sources to avoid inaccuracies
- Data Sensitivity: Ensure data used for AI inputs aligns with privacy and security policies
- Prompt Injection Protection: Use clear, specific prompts to minimize risks of unintended or malicious outputs
These principles and best practices adopted by BNSF will continue to develop as technology evolves to ensure responsible and ethical use.
Confidential Information & Intellectual Property
Why It's Important
Just as individuals protect their credit card information and social security numbers, BNSF must protect its Confidential Information. Any Confidential Information you receive or create in the course of your work is private Company information, and you are responsible for protecting it.
Disclosing Confidential Information
Don't disclose Confidential Information to any person who is not a BNSF employee or otherwise unauthorized to receive it or is not bound by a written confidentiality agreement or similar obligation. When you have a legitimate business need to share Confidential Information with authorized recipients, do so securely. If you believe you are compelled to disclose Confidential Information during a legal proceeding, notify BNSF's Vice President Compliance and Audit and the Law Department in advance.
INTEGRITY CHECK:
Spread the Word or Mum’s the Word?
Let’s say you are part of a team preparing a bid for a potential new customer. An existing customer hears rumors about this and asks you “off the record” about what sort of special terms are being offered to the new customer. To maintain a strong relationship with the existing customer, should you respond?
The Right Track
You should never reveal proprietary, non-public information concerning any business transaction to anyone not authorized to receive such information.
Key Guiderails
Protecting Confidential Information
Here are three tips to keep in mind when dealing with
Confidential Information:
Keep it secure.
Protect and hold all Confidential Information in strictest
confidence, taking steps as needed to protect it from risks
that could compromise its security, confidentiality or integrity.
Don’t remove or delete any Confidential Information, except
in the proper performance of your job.
Share it appropriately.
Only individuals with a legitimate BNSF business reason to
know Confidential Information are authorized to possess,
access or disclose Confidential Information.
Use it appropriately.
Never use any Confidential Information for your own personal
benefit.
Types of Confidential Information
Confidential Information is any nonpublic information about an individual or organization that, if disclosed, could adversely impact that individual or organization, such as exposing the individual or organization to criminal or civil liability or damage to the individual or organization's financial standing, employability, privacy or reputation. BNSF classifies our information into four categories defined below. Information that meets the classifications of Restricted Confidential Information, Financially or Operationally Sensitive Information or Business Important Information is considered Confidential Information.
Restricted Confidential Information
This classification applies to all information, in its full or abbreviated format, that is subject to federal or state regulations governing its collection, disclosure, use or protection. Examples of Restricted Confidential Information include Consumer Personal Information (CPI), Payment Card Information (PCI), Protected Health Information (PHI) and Personally Identifiable Information (PII). Information for which BNSF has confidentiality obligations pursuant to a non-disclosure or similar agreement is also Restricted Confidential Information.
Financially or Operationally Sensitive Information
This classification applies to information that is critical to the operations of BNSF, or that represents or is used in the reporting of the financial or operational performance of BNSF. Examples of Financially or Operationally Sensitive Information include information used (a) in transportation operations; (b) for determining the health, performance, maintenance or replacement of key assets; (c) for revenue and payment management; (d) in external reporting of financial and operational performance as required by the SEC, STB or FRA; and (e) in other critical processes.
Business Important Information
This classification applies to information that is used in the routine business of BNSF but does not fall within the definition of Restricted Confidential Information or Financially or Operationally Sensitive Information. Business Important Information includes all nonpublic or proprietary information about BNSF and BNSF's current, past or prospective employees, shareholders, business partners, customers, vendors and suppliers. Examples include (a) commercially sensitive information about BNSF customers; (b) BNSF "trade secrets" as defined by federal and applicable state law and any other form of BNSF intellectual property or other confidential or proprietary information or trade secrets belonging to BNSF; (c) Policies, Rules, and Procedures; and (d) daily individual work product not falling into more restrictive categories.
General Information
This classification applies to BNSF information that is of minimal value due to its type or use and for which the disclosure, modification or destruction would not be expected to impact BNSF operations, assets or employees. General Information includes that which is intended for public audiences or is generally publicly available from outside sources.
Handling PII and PHI
Some Restricted Confidential Information is particularly sensitive. Specifically, Personally Identifiable Information (PII) and Protected Health Information (PHI) are subject to further restrictions. PII includes an individual’s first name or initial and last name when combined with another personal identifier, such as a Social Security Number or date of birth. Before transmitting or sharing PIl or PHI, consider the following:
- Is there a legitimate business need to disclose the PII or PHI, or can it be removed or redacted from the communication?
- Is the transmission of the PII or PHI appropriately secured, such as using approved encryption solutions described in the Information Security Procedures?
- Is the recipient approved to view PII containing SSNs as provided in the Information Governance & Confidentiality Policy?
PII and PHI must be encrypted when emailed and the user must be connected to the BNSF network or remotely connected to the BNSF network using the VPN client when sending the email. In addition, encrypting CPI when sending in an email will provide extra security through transmission.
Intellectual Property
Intellectual Property (IP) is another area that requires special attention. In addition to protecting the confidentiality of IP, employees who create IP, including hardware, data, and software, must promptly notify the Associate General Counsel in the Law Department. Any user transmitting IP must be connected to the BNSF network or remotely connected to the BNSF network using the VPN client and use a BNSFapproved application, website, or software. BNSF will work with the employee to determine the steps necessary to ensure the appropriate treatment and protection of the IP. BNSF owns all IP made or created by BNSF employees during their employment with BNSF and made or created within 12 months after the employee leaves BNSF.
IP belonging to third parties must also be protected. Be sure BNSF has the appropriate permissions before using any IP belonging to a third party in the course of your BNSF work.
External Communications and Social Media
BNSF Policies govern external communications across all forms of media including print, online platforms and public forums. Never discuss BNSF's Confidential Information in public areas, social conversation or while on social media platforms.
Government Requests for Information
BNSF cooperates with reasonable requests by federal, state and municipal government officials seeking information concerning company operations and personnel. Typical requests include:
- Requests made for information by inspectors of the Federal Railroad Administration during routine inspections.
- Inquiries by government planning agencies for information not considered commercially sensitive.
- Law-enforcement requests to BNSF Resource Protection for information involving routine matters.
Employees should consult with the appropriate BNSF department regarding non-routine government requests for information, including attorney general or inspector general requests or subpoenas for information. If any government agency requests an interview with BNSF personnel or seeks data, documents or access to files refer to the following departments:
- Tax Department for tax-related matters.
- Environment & Sustainability Department for environmental matters.
- Law Department for all other matters.
Social Media Use
Be careful when using social media – even when you are chatting with your coworkers, remember the potential risks to you and to our Company. Once Confidential Information has been posted, it cannot be recovered, and this may result in damage or liability for the Company and you personally. The same goes for offensive and defamatory information.
Be responsible in all social media use and never discuss Confidential Information on social media. BNSF employees must uphold the same standards of professionalism and respect online as they are expected to in the workplace. When posting on social media in a personal capacity, employees must clearly state that their views are their own and must avoid implying company endorsement.
External Communications
Before making external presentations or publishing videos, printed materials or Internet postings on behalf of BNSF, contact Corporate Relations for approval. Similarly, if you are asked by the media or a customer to comment publicly on any topic, direct that inquiry to Corporate Relations, as required by the Corporate Relations Policy. Unless you are authorized to do so, it's never appropriate to talk to the media. Requests from the media must be directed to Corporate Relations.
Consult and Report
If you are uncertain about a particular confidentiality issue, or you become aware of a confidentiality problem (including one that involves other coworkers), you can find out who to contact here. For more information, see the Information Governance & Confidentiality Policy, Corporate Relations Policy, and Social Media Policy.
Records & Information Governance
Why It's Important
Appropriately maintaining records at all times is vital to our business. We all create, use and dispose of information in many forms every day, including electronic and hard-copy formats. Appropriate records management is a critical part of our Records and Information Governance program. Information, such as a rough draft, your personal meeting notes or even a duplicate copy of a contract or other Record, does not have retention requirements. Records, such as contracts, accounting ledgers, payroll, regulatory inspections or certain communications with customers and suppliers, must be retained for a specified period of time as evidence of the business activity by our Company. Any ongoing business activities or communications that provide evidence of our Company transactions, business decisions, employment practices or policies must be maintained as a Record.
You have a role in ensuring Records are properly maintained at all times, from their creation through their proper handling and disposal. For additional information, see the Records and Information Management Policy.
WHEN ON LEGAL HOLD, NOTHING GOES
Employees are required to fully comply with all legal hold orders, which mandate the preservation of specific records, regardless of their format or location. Records covered by a Hold Order must be retained even if they are beyond their retention period and can only be disposed of once they are no longer the subject of a Hold Order.
Preserving records under a hold order is not optional – it is a legal obligation and a critical part of ethical business conduct.
Following the Record Retention Schedule
The Record Retention Schedule is part of our Records and Information Management Policy and defines our requirements for retention and proper disposal for each type and classification of Record that is created or used across the Company. Note that in Records management, "disposal" is a set of rules for the deletion and destruction of Records.
The Record Retention Schedule organizes Records into Record classes or business groups. These groups typically support similar business processes or have related legal or operational retention requirements. Each Record class is given a set retention period. Some Records may need to be kept permanently for Vital or Historical purposes.
Vital and Historical Records
Vital Records are critical to establishing the Company's legal identity or rights, or establishing or proving the Company's financial position. Examples of Vital Records include deeds, land grants, maps documenting title and documentation of financial interests. Vital Records require special attention and enhanced protection.
Historical items or artifacts are deemed valuable by their contribution to BNSF legacy, history, or culture. Examples of Historical items and artifacts include maps, artwork, legacy newsletters, publications, press releases and photographs. Employees who are aware of, or discover, vital or historical items must contact the Records and Information Management Team.
FOR MORE INFORMATION ON ACTING WITH INTEGRITY IN PROTECTING WHAT POWERS US
If you have questions, you can find out who you need to contact here.