Department of Justice/Federal Bureau of Investigation

System Management

1. a. Which FBI Division is the system sponsor?
Criminal Justice Information Services (CJIS) Division

b. Who is the point of contact for the system sponsor?
Thomas E. Bush, III
Assistant Director
CJIS Division
FBI
Module C3
1000 Custer Hollow Road
Clarksburg , West Virginia 26306
Phone: (304) 625-2700
Fax: (304) 625-4498

2.a. Which FBI Division is the system developer?
CJIS Division

b. Who is the point of contact for the system developer?
David Cuthbertson
Acting Deputy Assistant Director
N-DEx Executive Manager
Policy, Administrative and Liaison Branch
CJIS Division
FBI
Module C3
1000 Custer Hollow Road
Clarksburg , West Virginia 26306
Phone: (304) 625-2740
Fax: (304) 625-3875

Attributes of the Data

When requirements for the data to be used in the system are being determined, those requirements must include the privacy attributes of the data. The privacy attributes are derived from the legal requirements imposed by the Privacy Act of 1974. First, the data must be relevant and necessary to accomplish the purpose of the system. Second, the data must be complete, accurate, and timely. It is important to ensure that the data has these privacy attributes in order to assure fairness to the individual in making decisions based on the data. That being said, the Privacy Act also permits the head of an agency to exempt a system of records from certain requirements of the Privacy Act. For example, a law enforcement agency can exempt various law enforcement records from certain provisions of the Privacy Act. Agencies are also permitted to exempt investigatory material compiled solely for the purpose of making a suitability determination for federal employment. Please respond to the following questions with regard to attributes of the data:

1. Is the use of the data both relevant and necessary to the purpose for which the system is being designed? If not, explain the justification for using the data notwithstanding.
Yes.

2. a. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected?
The N-DEx will aggregate already existing law enforcement information in incident, offense, and/or case reports; arrest, booking, incarceration data; parole and probation; and the CJIS Division's SoS; the system will then search for linkages. The N-DEx system will make apparent linkages between already existing law enforcement information that were previously not apparent. In addition, audit logs will indicate to system users if other users have accessed the same data, thereby making connections among queries more transparent.

Any correlations made between records in the N-DEx will create a metadata record and a corresponding audit log. The metadata record tracks the correlation made between the records. When personally identifiable information appears in the metadata, the system will make available information about an individual that was previously not apparent. In some cases the metadata record may not contain any substantive information identifiable to an individual.

b. Will any newly created data be considered a record for purposes of the Privacy Act?
The record created when a linkage is made between records in N-DEx is metadata. This metadata may be considered a record for purposes of the Privacy Act depending upon whether it contains personally identifiable information; if so, it will be handled in conformance with all Privacy Act requirements.

c. Can the system make determinations about individuals that would not be possible without the new data?
The N-DEx can make potential linkages between crime incidents, criminal investigations, and related criminal proceedings that were not previously apparent. In the event a linkage is made, the system can electronically notify the respective agencies that own the potentially matching records. Those agencies can then determine whether to pursue the linkages. The agencies, however, may not use the information as a basis for action or further dissemination without the permission of the contributing agency except pursuant to an "exigent circumstance” as stated in the N-DEx dissemination policy. This permission policy will help ensure that the underlying information is verified and updated as necessary before further action is taken on it.

d. How will the new data be verified for relevance and accuracy?
The metadata will contain only correlations between records; the records must be verified. Agencies may not use information in the N-DEx as a basis for action or further dissemination without the permission of the contributing agency except pursuant to an “exigent circumstance” as stated in the N-DEx dissemination policy. This permission policy will help ensure that the underlying information is verified and updated as necessary before further action is taken on it.

3. a. If data are being consolidated, what controls are in place to protect the data from unauthorized access or use?
Data are being correlated, not necessarily consolidated. Nevertheless, the system will maintain strict controls. Unauthorized access or use will be monitored by audits of participating agencies. The N-DEx system will track each user to deter misuse and sanctions will be established and enforced.

b. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.
Please refer to previous answer.

4. How will the data be retrieved? Can it be retrieved by an individual’s name or other personal identifier? If yes, explain.
Data can be retrieved by authorized law enforcement personnel in two ways: by submitting an incident, offense, and/or case report, or by performing a query.

Data can be retrieved by name or other personal identifiers, as well as by incident type, modus operandi, or other relevant factor. Any user that submits data or makes a query that correlates with other information in the system, may be able to view data that contains names or other personal identifiers. What the user would see or have access to would be based on their access role and/or the level of sensitivity of the information.

5. What are the potential effects on the privacy of individuals due to:

a. Consolidation and linkage of files and systems .
The N-DEx will search information that has been lawfully collected so that it can be correlated to find potential relationships between criminal investigations, crime incidents, and other criminal justice information. This information is already accessible by law enforcement officers, to some extent, but linkages among the data may be functionally obscure due to physical separation, time, and other constraints.

The N-DEx will make more readily apparent existing linkages or connections that already exist in criminal justice information. While this has the potential to have an impact on personal privacy, the correlations may help resolve outstanding criminal matters more quickly. In such cases, any adverse impact on privacy is outweighed by the benefit to society of resolving crimes. It is expected, moreover, that the N-DEx may generate linkages that will provide exculpatory information which may mitigate effects on an individual’s privacy.

b. Derivation of data.
The only data that are "derived" from operation of the N-DEx are metadata. To the extent that the metadata contain personally identifiable information, it makes available information about an individual that was previously not apparent. In many cases, however, the metadata record may not even contain any substantive information identifiable to an individual, from either of the records which made the linkage.

Even if the metadata do contain information identifiable to an individual, the purpose of the metadata is to track the correlation/linkage between records in the N-DEx. Law enforcement users of the system will not see the metadata. Even if someone were to see the metadata it would only contain substantive information that already exists in the records that have been correlated. The N-DEx has policies in place to enforce system discipline and ensure that contributed records are verified for relevance and accuracy. There should be little privacy impact from information derived from that data, which can be used only with permission and only after re-verification.

c. Accelerated information processing and decision making.
It is a goal of the N-DEx that by correlating law enforcement information it will dramatically improve the process of making linkages and connections between investigations and crime incidents to help solve and deter crime. The N-DEx system will make apparent linkages between already-existing law enforcement information that were previously not apparent. Any impact on individual privacy, however, will be mitigated by the societal benefit of faster resolution of criminal incidents.

d. Use of new technologies.
The N-DEx will identify potential links, relationships, and matches of the data submitted by participating agencies. These information relationships will be similar to those made by investigators today and the new tools will accelerate the process. However, the new tools will identify relationships or "connect the dots" about data that was previously functionally obscure. It will use link analysis to make apparent relationships that were not previously apparent. The impact on the privacy of individuals will be similar to the impact of any current law enforcement analysis and investigation.

e. How are the effects to be mitigated?
Any effect on privacy will be mitigated in several ways. Controls will be imposed on the dissemination of correlations based on levels of sensitivity layered with the use of role-based access. In addition, before further action can be taken with regard to any correlations that are disseminated, permission of the contributing agency must be obtained. Audit controls, security regulations and sanctions for misuse will be used to ensure system discipline and adherence to these rules.

6. Does the information consist of any of the following? If so, explain.

a. Information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrest, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status.
The information contained in the

N-DEx will be criminal justice information including incident, offense, and/or case reports which may include notations of arrest, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status. This information may be associated with an identifiable individual who is associated with a criminal incident or investigation.

b. Information compiled for the purpose of a criminal, intelligence, or foreign counter-intelligence investigation, including reports of informants and investigators, and associated with an identifiable individual.
The N-DEx system will not contain information categorized as intelligence, but instead, will be criminal justice information, which may include reports of investigators and informants and may be associated with an identifiable individual.

c. Reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.
Yes. Incident, offense, and/or case reports will contain details of crime incidents and investigations which will include information identifiable to an individual such as an offender/suspected offender. Arrest, booking, and incarceration data also consists of criminal justice information identifiable to an individual who has been arrested/booked and/or incarcerated.

7. Does the information meet any of the following criteria? If so, explain.  

a. Is the information classified?
No. The N-DEx system is designated as an Sensitive But Unclassified system.

b. Is the information investigatory material compiled for any other law enforcement purpose than those set out in 6 (a), (b), or (c) above?
Question 6 describes the investigatory material that is compiled in N-DEx.

c. Is the material required by statute to be maintained and used solely as statistical records?
No.

d. Is the information investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contract, or access to classified information?
No.

e. Is the information testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process?
No.

8. Does the information describe how an individual exercises First Amendment rights? If so, explain whether this is authorized by statute or the individual to whom the record pertains, or how it is pertinent to and within the scope of an authorized law enforcement activity.
To the extent that any of the information bears on the exercise of First Amendment rights, such information is pertinent to and within the scope of an authorized law enforcement activity

Introduction

As part of its E-Government initiatives, the Department of Justice (DOJ) has identified improved information sharing to the entire law enforcement community as a key goal. DOJ has developed a strategy, the Law Enforcement Information Sharing Program (LEISP), to guide the investment of its information sharing resources. The Law Enforcement National Data Exchange (N-DEx), a scalable information sharing network, is at the center of the LEISP architecture. The N-DEx, a repository of information from federal, state, local and tribal law enforcement entities, will provide the capability to make potential linkages between crime incidents, criminal investigations, arrests, bookings, incarcerations, parole and/or probation in order to help solve, deter and prevent crimes and, thereby, improve homeland security.

Data in the System

The sources of the information in the system are an important privacy consideration if the data are gathered from other than FBI records. Unless the Privacy Act permits an exemption, information collected from non-FBI sources should be verified, to the extent practicable, for accuracy, that the information is current, and that information is complete. This is especially important if the information will be used to make determinations about individuals. Please respond to the following questions with regard to the sources of the data in the system:

1. Generally describe the information to be used in the system, how it will be used, and who will use it?

 Information Being Used :

Data for the N-DEx system will come from the following main sources. It is important to note that the information utilized by the N-DEx is already collected by law enforcement agencies in fulfilling their official law enforcement functions.

A. Incident, Offense, and Case reports comprised of specific identifying data and nonspecific descriptive data from local, state, tribal, and federal law enforcement.

The N-DEx will contain data from state, local, and tribal or federal criminal incident, offense, and/or case reports. These incident, offense, and/or case reports contain personally identifiable information (names, addresses, etc.), as well as non-identifying descriptive data (type of weapon involved, location of offense, etc.), about crime incidents and criminal investigations.

These incident, offense, and/or case reports are comprised of structured information that allows the N-DEx to automatically correlate the names, addresses, telephone numbers, offense locations, type of weapon, etc., in the incident, offense, and/or case reports against one another to identify potential linkages. These incident, offense, and/or case reports will be submitted to the N-DEx by each law enforcement agency pursuant to and compliant with their own state laws, guidelines, and agency policies and practices.

B. Arrest, Booking, Incarceration, and Parole and/or Probation information.

The N-DEx will contain information from the arrest, booking, incarceration, parole and/or probation information of offenders associated with crime incidents and/or investigations. Arrest, booking, and incarceration data also contain specific descriptive information about individuals arrested in association with crime incidents or investigations. This information will be correlated against the incident, offense, and/or case reports submitted to N-DEx.

An offender/arrestee may provide a range of information throughout the criminal justice process often with varying degrees of veracity. However, all of the information the arrestee/offender provides may have law enforcement value.

Appendix A describes the data elements in detail. In order to encourage participation by non-federal agencies, the data contributed by these agencies will be subject to Memoranda of Understanding (MOU) that reserve ownership and control to the contributor. The contributors will also be responsible for ensuring the integrity of the data, as described more fully below.

C. Data housed in other FBI CJIS Division's System of Services (SoS), such as the National Crime Information Center (NCIC), Interstate Identification Index (III), and Integrated Automated Fingerprint Identification System (IAFIS) .

The CJIS Division's SoS serves as an existing archive of law enforcement criminal justice data (criminal history, wanted notifications, etc.), and as an investigative tool to deter, prevent, and solve crimes, and aid in homeland security. Data from the FBI CJIS Division's SoS, which includes the NCIC, III, and IAFIS, is critical to the success of the N-DEx. The N-DEx will make automatic queries of the CJIS SoS, but the N-DEx will not retain the information except for auditing purposes. The queries for the CJIS Division's SoS will not be ingested.

How the information will be used:

The N-DEx will provide the capability to make potential linkages between crime incidents, criminal investigations, arrest, booking, incarceration, parole and/or probation information contained in the CJIS Division's SoS. The information provided by these linkages will help deter, prevent, and solve crimes as well as aid in homeland security.

Each incident, offense, and/or case report submitted to the N-DEx will remain in a data repository to be correlated against future incident, offense, and/or case report submissions. For example, with each additional submission of an incident, offense, and/or case report the N-DEx will automatically correlate the newly submitted report against the previously submitted reports. Additionally, the N-DEx will automatically correlate the information in the submitted incident, offense, and/or case report against arrest, booking, and incarceration data, as well as the CJIS Division's SoS.

If a potential match occurs, the N-DEx will have the capability to electronically notify the respective contributing agencies of the potentially matching records. As an example, if an address in an incident, offense, and/or case report matches an address in another incident, offense, and/or case report or possibly a III record, the N-DEx will make the correlation and may electronically notify the agencies owning the records.

The DOJ’s LEISP will be used to determine further dissemination, based on three different levels of sensitivity:

Full Access (Green) - If the submitter of a data record (e.g., incident report, arrest report) has designated it to be fully shared, then all N-DEx users with the appropriate access authority will have access to the full record and all data elements within the record.

Pointer-Based Access (Yellow) - If the data submitter decides that access to a specific record, or specific data elements should be restricted except under certain circumstances, then the data submitter can designate the record accordingly using pointer-based sharing. With pointer-based sharing, any user that gets a "hit," or attempts access to a record with this designation, will be provided with information on how to contact the designated record submitter (i.e. the POC for the record) only. It is then the responsibility of the data requestor to contact the data submitter who will determine whether the record can be shared. If so, N-DEx provides mechanisms so that the data submitter can make accessible that information to a specific user or group of users as applicable.

Restricted Access (Red) - There will be circumstances where a data record or part of the record is so highly sensitive that the data contributer completely restricts access to it and to any knowledge of that record to a selected user or user group. The value of having the record in N-DEx is that the data submitter can benefit from correlations made with other N-DEx records without compromising the information contained in the sensitive record. With restricted access, any "hits" against the restricted record will be known to the submitter user/group while the submitter of the other record that it hit against will have no knowledge of the correlation.

This strategy will be implemented by allowing agencies to submit information to the N-DEx and, in effect, share it for correlation purposes, but control its dissemination. The N-DEx will provide the capability for the information contributor to categorize its information when submitted using these levels of sensitivity. If a correlation is made, the dissemination of the information will be commensurate with the level of sensitivity. This capability will allow agencies to submit information for sharing but control the dissemination of sensitive information to protect investigative equities and privacy.

The N-DEx will not include intelligence information. It will not query information from non-law enforcement or public source databases (i.e. credit reports or background checks).

Who will use the information:

The N-DEx system’s law enforcement sensitive outputs will be available for use by local, state, tribal, and federal law enforcement agencies. An authorized user of the N-DEx will be an employee of a law enforcement agency, designated by the agency head. The users identified by the agency head will use the system as an investigative tool to search, link, analyze, and share criminal justice information.

System access to the specific functions of the N-DEx will be commensurate with the users job function in their respective agency or department. However, use of the N-DEx system will be restricted to a limited number of agencies during the initial deployment.

2. Does the data qualify as records for purposes of the Privacy Act?
The data contributed by components of the DOJ, other federal agencies, and state, local, and tribal entities are considered to be "maintained" by the FBI for purposes of the Privacy Act of 1974. However, beyond the "maintenance" of data contributed by other federal agencies and state, local, and tribal entities, the FBI is limited by the terms of the MOU with respect to that data.

3. What are the sources of the information in the system?

a. What FBI files and databases are used?
The FBI may contribute investigative information which would come from the FBI’s case tracking system (currently the Automated Case Support).

b. What federal agencies are providing data for use in the system?
The following federal entities may provide information:

- Air Force Office of Special Investigations
- Bureau of Alcohol, Tobacco, Firearms and Explosives
- Bureau of Prisons
- Drug Enforcement Agency
- Department of Justice Joint Automated Booking System (query only)
- United States Marshal's Service

c. What state, local, and/or foreign entities are providing data for use in the system?
No foreign agencies will be providing data.

The first state/local agencies scheduled to provide data to the Law Enforcement National Data Exchange are:

- Las Vegas Metropolitan Police Department
- Los Angeles County, CA Sheriff’s Office
- San Diego, CA Automated Regional Justice Information System
- Orange County, CA Sheriff’s Department
- State of Alabama
- State of Delaware, Delaware Justice Information Services
- State of Georgia ( Marietta, Georgia)
- State of Maryland
- State of South Carolina
- State of Tennessee ( Nashville Police Department, Chattanooga Police Department)
- Commonwealth of Virginia ( Alexandria Police Department)
- State of West Virginia

d. What other third party sources will contribute data to the system?
None.

4. (a, b, c). How will data collected from sources other than FBI records be verified for accuracy, completeness, and timeliness?
The N-DEx, through the CJIS Division's Advisory Process, has established a policy that each data contributor will have an obligation to maintain “system discipline”. That is, it must maintain, timely, accurate, and complete information in the N-DEx.

In an effort to maintain system discipline, contributors shall submit data, including any updates or changes to the original submission, on at least a monthly basis.

Compliance with the above policy, consistent with long-standing CJIS Division's user agreements and the CJIS Audit Unit policy, will be part of an audit program for the N-DEx.

The N-DEx information may not be used as a basis for action or disseminated for any other purpose or in any other manner outside the participating agency that accessed the information, unless that agency first obtains the permission of the contributing agency or unless exigent circumstances exist, as explained below. This permission policy will help to ensure that before action is taken, the underlying information can be verified and updated as necessary. Specifically included within this prohibition is any inclusion of the N-DEx information in an official investigative or case file, and any use of N-DEx information in the preparation of judicial process such as affidavits, warrants, or subpoenas.

In exigent circumstances, immediate dissemination of N-DEx information can be made without the permission of the contributing agency. Exigent circumstances comprise the following:

(a) there is an actual or potential threat of terrorism, immediate danger of death or serious physical injury to any person, or imminent harm to national security; and

(b) it is necessary to disseminate such information without delay to any appropriate recipient for the purpose of preventing or responding to that threat.

The contributing agency shall be notified of any dissemination made under this exception.

b. How will data be checked for completeness?
Reference complete answer under 4a.

c. Is the data current? How do you know?
Reference complete answer under 4a.

5. Are the data elements described in detail and documented? If yes, in what document?
Yes. See Appendix A.

6. Is this a new collection of data or modification of an existing collection?
The N–DEx will aggregate existing collections of law enforcement information to search for potential linkages and connections back to the source systems for recordation.

7. How many records will be contained in the system?
It is difficult to ascertain, at this time, the number of records that will reside in the N-DEx data repository at full operational capacity. During initial deployment, it is estimated that the number of records in the N-DEx may be approximately 30-35 million records.  

Access to the Data

Who has access to the data in a system must be defined and documented. Users of data can be individuals, other systems, and or other agencies. Individuals who have access to the data can be system users, system administrators, system sponsors, managers, contractors, and developers. When individuals are granted access to a system, their access should be limited, where possible, to data needed to perform their assigned duties. If individuals are granted access to all of the data in a system, procedures need to be in place to deter and detect browsing and unauthorized access. Other systems users could be programs or projects that interface with the system and will have access to the data. Other agency users can include international, federal, state, tribal, or local entities that have access to FBI data. Who will have access to FBI data? Please respond to the following questions with regard to access to the data:

1. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Contractors, other Law Enforcement Agencies, and Task Force Members, Other)? Please explain .
Access to the data in the system will be limited to authorized system managers/administrators, developers, contractors, and select law enforcement personnel.

2. How is access to the data by user determined? Are criteria, procedures, controls, and responsibilities regarding access documented?
Access to the data in the system will be limited to a select number of users in each agency determined by the agency head for law enforcement investigative purposes. The agency head’s responsibility will be coordinated through the CJIS Division's Systems Officer, who will designate authority to manage and control access. Criteria, procedures, controls, and responsibilities will be determined by the CJIS Division's Advisory Policy Board (APB).

3. Will users have access to all data in the system or will the user’s access be restricted? Explain.
Users will not have access to all data in the system; instead, access is determined by role and need to know. Upon submission of an incident, offense, and/or case report or a query of the system, which would make a positive correlation, the user will have access to data which link to the incident, offense, and/or case report or query, subject to controls placed upon the data by the submitter. In addition to protecting generally sensitive investigations, these controls will facilitate the protection of particular kinds of data such as juvenile offender or victim information. If no correlations are made, the user will not receive any information.

For system development purposes, system developers, administrators, contractors, and CJIS Division's N-DEx personnel may have access to some or all data in the system.

The N-DEx system is designed so that law enforcement agencies will have sufficient access to ensure that all data they submit are accurate, timely, and complete. Auditing capabilities, nevertheless, will allow usage of the N-DEx to be tracked, regardless of user role or access level. These policies and practices, along with the ability to limit dissemination of sensitive information will ensure the protection of data in the system.

4. a. What controls are in place to prevent the misuse (e.g. browsing) of data by those having access?
The N-DEx will employ system controls to prevent users from receiving data that is not commensurate with their access level.

Each user will be assigned a unique user name and password. These will be contained in a transaction log that tracks system usage.

The CJIS Division's Audit Unit will identify misuse of the N-DEx system by conducting periodic audits of the participating law enforcement agencies. The N-DEx system will track each user profile regardless of user role or access level to deter misuse of the data. Through the CJIS Division's Advisory Process, sanctions for misuse will be established and enforced. Users will acknowledge sanctions for misuse via a warning banner prior to accessing the system.

b. Does any proposed contract include a provision requiring contractors to adhere to the provisions of the Privacy Act?
Yes.

5. a. Do other systems share data or have access to data in this system? If yes, explain.
In order to participate in the N-DEx, other entities may submit data through existing information sharing systems.

b. Who will be responsible for protecting the privacy rights of the individuals affected by any interface?
All users and participating agencies of the N-DEx will be responsible for protecting the privacy interest of individuals, just as they are now, consistent with law enforcement business practice. Additionally, all users and participating agencies will be responsible for compliance with all applicable federal, state, and local laws and agency policies and practices established for the protection of individual privacy rights.

c. What are the cumulative effects on individual privacy due to any linkage between systems?
Data about crimes and criminal incidents, which are already collected by law enforcement as part of its legally authorized mission and which were previously functionally obscure, will now be more readily apparent and retrievable. Therefore, the cumulative effect on individual privacy is that N-DEx users potentially will have access to more information about suspected offenders, witnesses, or victims from related criminal incidents or events involving those same individuals. The advantage for N-DEx users will be the ability to draw from this linkage a more complete, and far more timely, investigative analysis which should, in turn, lead to a more effective and efficient resolution of the investigation. This enhanced ability to solve crimes, identify perpetrators, eliminate misidentification of the innocent, and assist victims -- coupled with the capability of N-DEx to robustly monitor information sharing practices -- far outweighs any cumulative impact on the privacy of individuals whose information is already lawfully included in law enforcement records throughout the country.

6. a. Will other agencies share data with, have access to, or receive data from this system (International, Federal, State, Local, Other)?
Yes. Data will be shared, subject to use restrictions, with participating federal, state, local or tribal agencies where correlations have been made. In addition, the N-DEx system has been designed to allow for expansion to include more agencies as the need arises.

b. If yes, how will data be accessed by or distributed to these other agencies?
The CJIS Division will deliver the N-DEx on the CJIS Wide-Area Network (WAN). Connectivity to N-DEx from law enforcement agency systems and users will be through any means authorized in accordance with CJIS APB policies and guidelines and in consultation with their state policy. Methods of connectivity may vary between law enforcement agency users connecting to the CJIS WAN from secondary locations. In many states, this will be accomplished through the existing state law enforcement networks (e.g., National Law Enforcement Telecommunications System [The International Justice and Public Safety Information Sharing Network], Regional Information Sharing System.NET state network).

Law enforcement agencies will also be able to connect to the N-DEx via secure Internet connections using the Law Enforcement Online system.

c. How will the data be used by the outside agency?
The information will be used by the outside agencies for criminal investigation purposes only and cannot be accessed or used for any other purpose, including but not limited to general licensing, employment, eligibility for federal or state benefits, and public background investigations.

The N-DEx information may not be used as a basis for action or disseminated for any other purpose or in any other manner outside the participating agency that accessed the information, unless that agency first obtains the permission of the contributing agency or unless exigent circumstances exist, as explained below. This permission policy will help to ensure that before action is taken, the underlying information can be verified and updated as necessary. Specifically included within this prohibition is any inclusion of the N-DEx information in an official investigative or case file, and any use of N-DEx information in the preparation of judicial process such as affidavits, warrants, or subpoenas.

In exigent circumstances, immediate dissemination of N-DEx information can be made without the permission of the contributing agency. Exigent circumstances comprise the following:

(a) there is an actual or potential threat of terrorism, immediate danger of death or serious physical injury to any person, or imminent harm to national security; and

(b) it is necessary to disseminate such information without delay to any appropriate recipient for the purpose of preventing or responding to that threat.

The contributing agency shall be notified of any dissemination made under this exception.

d. Who is responsible for assuring proper use of the data?
All users and the participating agencies of the N-DEx will be responsible for ensuring appropriate use of information made available through the system. Any limitations or guidelines on the appropriate use of information will be outlined in MOUs with participants. Contributing agencies are responsible for adherence to applicable federal, state/local laws and agency policies that are germane to sharing law enforcement information. The proper use of information will be enforced through a CJIS Division Audit process.

e. How will the system ensure that outside agencies only get the information to which they are permitted uses?
Users will not have access to all data in the system. If the submission of an incident, offense, and/or case report or a query to the system produces a positive correlation with other information in the N-DEx, the user may have access to the data that correlates to the incident, offense, and/or case report or query. If no correlations are made, the user will receive no information. The N-DEx will allow each contributing agency to configure a template that will control what information the N-DEx accepts and what it may disseminate to another agency. System access rules will be enforced through audits.

f. Will this change in the future?
No.

7. a. Can individuals covered by the system access and correct their record?
Although the FBI has in place procedures that govern access and amendment to records covered by the Privacy Act, N-DEx records qualify for exemption from access and amendment pursuant to subsection (j)(2) of the Privacy Act. The FBI intends to promulgate a regulation in order to claim this exemption for these records.

b. If yes, describe the procedure they must use to do so.
N-DEx records will be exempt from Privacy Act access and amendment. The procedures available for access and amendment of FBI information in the N-DEx, therefore, will follow established FBI procedures found at 28 Code of Federal Regulations Part 16, Subpart A. Access and amendment to other records in the system will be governed by procedures followed by the contributing agencies.

c. Is there a reason to exempt the system from record access procedures by the subject of the record? If so, explain. (For example, would access to a system record by the subject jeopardize an ongoing criminal investigation?)
Yes, to avoid interference with criminal investigations, the N-DEx will request that the Attorney General exempt this system from subsection (c)(3) and (4); (d); (e)(1),(2), and (3); (e)(4)(G)(H) and (e)(8) and (g) of the Privacy Act pursuant to Title 5 United States Code sections 552a (j)(2).

Attributes of the Data

When requirements for the data to be used in the system are being determined, those requirements must include the privacy attributes of the data. The privacy attributes are derived from the legal requirements imposed by the Privacy Act of 1974. First, the data must be relevant and necessary to accomplish the purpose of the system. Second, the data must be complete, accurate, and timely. It is important to ensure that the data has these privacy attributes in order to assure fairness to the individual in making decisions based on the data. That being said, the Privacy Act also permits the head of an agency to exempt a system of records from certain requirements of the Privacy Act. For example, a law enforcement agency can exempt various law enforcement records from certain provisions of the Privacy Act. Agencies are also permitted to exempt investigatory material compiled solely for the purpose of making a suitability determination for federal employment. Please respond to the following questions with regard to attributes of the data:

1. Is the use of the data both relevant and necessary to the purpose for which the system is being designed? If not, explain the justification for using the data notwithstanding.
Yes.

2. a. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected?
The N-DEx will aggregate already existing law enforcement information in incident, offense, and/or case reports; arrest, booking, incarceration data; parole and probation; and the CJIS Division's SoS; the system will then search for linkages. The N-DEx system will make apparent linkages between already existing law enforcement information that were previously not apparent. In addition, audit logs will indicate to system users if other users have accessed the same data, thereby making connections among queries more transparent.

Any correlations made between records in the N-DEx will create a metadata record and a corresponding audit log. The metadata record tracks the correlation made between the records. When personally identifiable information appears in the metadata, the system will make available information about an individual that was previously not apparent. In some cases the metadata record may not contain any substantive information identifiable to an individual.

b. Will any newly created data be considered a record for purposes of the Privacy Act?
The record created when a linkage is made between records in N-DEx is metadata. This metadata may be considered a record for purposes of the Privacy Act depending upon whether it contains personally identifiable information; if so, it will be handled in conformance with all Privacy Act requirements.

c. Can the system make determinations about individuals that would not be possible without the new data?
The N-DEx can make potential linkages between crime incidents, criminal investigations, and related criminal proceedings that were not previously apparent. In the event a linkage is made, the system can electronically notify the respective agencies that own the potentially matching records. Those agencies can then determine whether to pursue the linkages. The agencies, however, may not use the information as a basis for action or further dissemination without the permission of the contributing agency except pursuant to an "exigent circumstance” as stated in the N-DEx dissemination policy. This permission policy will help ensure that the underlying information is verified and updated as necessary before further action is taken on it.

d. How will the new data be verified for relevance and accuracy?
The metadata will contain only correlations between records; the records must be verified. Agencies may not use information in the N-DEx as a basis for action or further dissemination without the permission of the contributing agency except pursuant to an “exigent circumstance” as stated in the N-DEx dissemination policy. This permission policy will help ensure that the underlying information is verified and updated as necessary before further action is taken on it.

3. a. If data are being consolidated, what controls are in place to protect the data from unauthorized access or use?
Data are being correlated, not necessarily consolidated. Nevertheless, the system will maintain strict controls. Unauthorized access or use will be monitored by audits of participating agencies. The N-DEx system will track each user to deter misuse and sanctions will be established and enforced.

b. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.
Please refer to previous answer.

4. How will the data be retrieved? Can it be retrieved by an individual’s name or other personal identifier? If yes, explain.

Data can be retrieved by authorized law enforcement personnel in two ways: by submitting an incident, offense, and/or case report, or by performing a query.

Data can be retrieved by name or other personal identifiers, as well as by incident type, modus operandi, or other relevant factor. Any user that submits data or makes a query that correlates with other information in the system, may be able to view data that contains names or other personal identifiers. What the user would see or have access to would be based on their access role and/or the level of sensitivity of the information.

5. What are the potential effects on the privacy of individuals due to:  

a. Consolidation and linkage of files and systems
The N-DEx will search information that has been lawfully collected so that it can be correlated to find potential relationships between criminal investigations, crime incidents, and other criminal justice information. This information is already accessible by law enforcement officers, to some extent, but linkages among the data may be functionally obscure due to physical separation, time, and other constraints.

The N-DEx will make more readily apparent existing linkages or connections that already exist in criminal justice information. While this has the potential to have an impact on personal privacy, the correlations may help resolve outstanding criminal matters more quickly. In such cases, any adverse impact on privacy is outweighed by the benefit to society of resolving crimes. It is expected, moreover, that the N-DEx may generate linkages that will provide exculpatory information which may mitigate effects on an individual’s privacy.

b. Derivation of data.
The only data that are "derived" from operation of the N-DEx are metadata. To the extent that the metadata contain personally identifiable information, it makes available information about an individual that was previously not apparent. In many cases, however, the metadata record may not even contain any substantive information identifiable to an individual, from either of the records which made the linkage.

Even if the metadata do contain information identifiable to an individual, the purpose of the metadata is to track the correlation/linkage between records in the N-DEx. Law enforcement users of the system will not see the metadata. Even if someone were to see the metadata it would only contain substantive information that already exists in the records that have been correlated. The N-DEx has policies in place to enforce system discipline and ensure that contributed records are verified for relevance and accuracy. There should be little privacy impact from information derived from that data, which can be used only with permission and only after re-verification.

c. Accelerated information processing and decision making.
It is a goal of the N-DEx that by correlating law enforcement information it will dramatically improve the process of making linkages and connections between investigations and crime incidents to help solve and deter crime. The N-DEx system will make apparent linkages between already-existing law enforcement information that were previously not apparent. Any impact on individual privacy, however, will be mitigated by the societal benefit of faster resolution of criminal incidents.

d. Use of new technologies.
The N-DEx will identify potential links, relationships, and matches of the data submitted by participating agencies. These information relationships will be similar to those made by investigators today and the new tools will accelerate the process. However, the new tools will identify relationships or "connect the dots" about data that was previously functionally obscure. It will use link analysis to make apparent relationships that were not previously apparent. The impact on the privacy of individuals will be similar to the impact of any current law enforcement analysis and investigation.

e. How are the effects to be mitigated?
Any effect on privacy will be mitigated in several ways. Controls will be imposed on the dissemination of correlations based on levels of sensitivity layered with the use of role-based access. In addition, before further action can be taken with regard to any correlations that are disseminated, permission of the contributing agency must be obtained. Audit controls, security regulations and sanctions for misuse will be used to ensure system discipline and adherence to these rules.

6. Does the information consist of any of the following? If so, explain.

a. Information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrest, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status.
The information contained in the

N-DEx will be criminal justice information including incident, offense, and/or case reports which may include notations of arrest, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status. This information may be associated with an identifiable individual who is associated with a criminal incident or investigation.

b. Information compiled for the purpose of a criminal, intelligence, or foreign counter-intelligence investigation, including reports of informants and investigators, and associated with an identifiable individual.
The N-DEx system will not contain information categorized as intelligence, but instead, will be criminal justice information, which may include reports of investigators and informants and may be associated with an identifiable individual.

c. Reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.
Yes. Incident, offense, and/or case reports will contain details of crime incidents and investigations which will include information identifiable to an individual such as an offender/suspected offender. Arrest, booking, and incarceration data also consists of criminal justice information identifiable to an individual who has been arrested/booked and/or incarcerated.

7. Does the information meet any of the following criteria? If so, explain.

 a. Is the information classified?
No. The N-DEx system is designated as an Sensitive But Unclassified system.

b. Is the information investigatory material compiled for any other law enforcement purpose than those set out in 6 (a), (b), or (c) above?
Question 6 describes the investigatory material that is compiled in N-DEx.

c. Is the material required by statute to be maintained and used solely as statistical records?
No.

d. Is the information investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contract, or access to classified information?
No.

e. Is the information testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process?
No.

8. Does the information describe how an individual exercises First Amendment rights? If so, explain whether this is authorized by statute or the individual to whom the record pertains, or how it is pertinent to and within the scope of an authorized law enforcement activity.

To the extent that any of the information bears on the exercise of First Amendment rights, such information is pertinent to and within the scope of an authorized law enforcement activity.

Maintenance of Administrative Controls

Automation of systems can lead to the consolidation of processes, data, and the controls in place to protect the data. When administrative controls are consolidated, they should be evaluated so that all necessary controls remain in place to the degree necessary to continue to control access to and use of the data.

Data retention procedures should be documented. Data retention procedures require review to ensure they meet statutory and/or agency record requirements. Precise rules must be established for the length of time information is kept and for assuring that it is properly eliminated at the end of that time. This should be coordinated with the FBI Records Officer who, as noted earlier, is the Chief, Information Management Section, and Information Resources Division.

The intended and potential capabilities for monitoring a system must be defined and safeguards must be installed to ensure the privacy of individuals and prevent unnecessary intrusion. Please respond to the following questions with regard to the maintenance of administrative controls:

1. a. If the system is operated in more than one site, how will consistent use of the system and data be maintained in all sites?
The N-DEx users will all be bound by the same set of rules controlled by auditing practices. Processes will be implemented to ensure that no contributor can act on any of the correlated data unless the data is first verified with the contributing agency. Additionally, queries will be performed only when a legitimate law enforcement need exists. This rule will be enforced through audits.

b. Explain any possibility of disparate treatment of individuals or groups.
There is nothing to suggest that the N-DEx will result in disparate treatment of individuals or groups.

2. a. What are the retention periods of data in this system?
Consistent with approved retention schedules for federal records, the N-DEx will retain FBI data for a period of ten years, unless prohibited by law or policy of the contributing agency. Other records in the system are maintained and disposed of in accordance with applicable statutory and regulatory requirements, and memoranda of understanding negotiated with data contributors.

b. What are the procedures for eliminating the data at the end of the retention period? Where are the procedures documented?
FBI records in the system are maintained and disposed of in accordance with the appropriate authority of the National Archives and Records Administration and in coordination with the Records Management Division. Each contributing agency will be responsible for disposing of its own records in accordance with appropriate rules. The procedures for documenting the data elimination process are found in the Law Enforcement N-DEx Concept of Operations version 1.5.

c. While the data are retained in the system, what are the requirements for determining if the data are still sufficiently accurate, relevant, timely, and complete to ensure fairness in makingdeterminations?
The N-DEx, through the CJIS Division's Advisory Process, has established a policy that each data contributor must maintain system discipline, which includes the timeliness, completeness, and accuracy of data they contribute to the system to ensure fairness in making determinations.

In an effort to maintain system discipline, contributors should submit data, including any updates or changes to the original submission, on at least a monthly basis. Because the N-DEx is a CJIS Division system, the CJIS Audit Unit has an audit plan for the N-DEx that includes auditing data for completeness, timeliness, and accuracy. It will be incumbent upon the contributing entity to modify its business practices and internal policies as necessary to ensure the relevancy, accuracy, and completeness of its records.

d. How will the system maintain an accounting of each disclosure of a record for 5 years or the life of the record, whichever is longer, as required by the Privacy Act? Please explain.
The N-DEx will maintain an accounting of the disclosure of a record through audit logs, which will be maintained for five years or the life of the record, whichever is longer. Through examination of audit trail records/logs, coupled with established business practices, records in the system will be traceable. Audit trail records will be reviewed periodically, consistent with participants' business practices.

3. a. Is the system using technologies in ways that the FBI has not previously employed?
The N-DEx harnesses existing technology for use in a new information sharing environment.

b. How does the use of this technology affect individual privacy?
The potential effect of the N-DEx on the privacy of individuals is believed to be minimal. The N-DEx will correlate information that has been lawfully collected to find potential relationships between criminal investigations, crime incidents, and other criminal justice information. This information is already accessible by law enforcement officers, but many times linkages between criminal justice information are disparate and law enforcement is not able to "connect the dots" due to physical separation, time, and other constraints. The fact that the dots can be connected more quickly could be construed as an impact on privacy, but that impact is mitigated by the benefit of solving crime more quickly. In addition to resolving crimes more efficiently, the N-DEx may generate linkages that will provide exculpatory information, which may mitigate effects on an individual’s privacy.

Ultimately, it is not the technology that may affect an individual's privacy, but the agencies' law enforcement business practice decisions that are made based on the information received from the N-DEx. Because those decisions can only be made with the approval of any office that contributed the information, the privacy impact from the system itself is minimal.

4. a. Will this system provide the capability to identify, locate, and monitor individuals? If yes, explain.
No. The purpose of the N-DEx is to determine relationships between criminal incidents in order to more efficiently resolve them. The system has no capability for monitoring real-time actions, the identification, or the location of the individual.

b. Will the system provide the capability to identify, locate, and monitor groups of people? If yes, explain.
Please refer to the previous question.

c. What controls will be used to prevent unauthorized monitoring?
There will be no monitoring of individuals or groups. Audit controls will be in place to enforce appropriate use of the N-DEx system.

5. What type of security is provided for the data in the system? Will the system require accreditation under the Computer Security Act (DOJ Order 2640.2e)? If so, attach a copy of the system security plan.
The system will require accreditation and the FBI's Security Division has been assisting the project management team in this effort. The system security plan is not complete at this time. However, before the system is implemented, the certification and accreditation process will have been completed and the system will have authority to operate.

6. Are the personnel involved in the design, development, operation and maintenance of the system trained on Privacy Act compliance?
Yes.

APPENDIX A

N-DEx
GLOBAL Justice Data Dictionary Data Elements

APPROVING OFFICIAL

________ /s/___________________________ ___ 4-6-07_____________

JANE HORVATH Date Privacy and Civil Liberties Officer

United States Department of Justice