[Federal Register: December 29, 2006 (Volume 71, Number 250)]
[Notices]
[Page 78446-78448]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr29de06-85]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
Office of the Secretary
[Docket No. DHS-2006-0076]
Privacy Act of 1974; System of Records
AGENCY: Privacy Office, DHS.
ACTION: Notice of Privacy Act System of Records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, the Department of
Homeland Security is giving notice that it proposes to add a new system
of records to its inventory of record systems for Department of
Homeland Security General Information Technology Access Account Records
System.
DATES: Written comments must be submitted on or before January 29,
2007.
ADDRESSES: You may submit comments, identified by Docket Number DHS-
2006-0076 by one of the following methods:
Federal e-Rulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.
Fax: 202-572-8727 (not a toll-free number).
Mail: Hugo Teufel III, Chief Privacy Officer, Privacy
Office, Department of Homeland Security, Washington, DC 20528.
FOR FURTHER INFORMATION CONTACT: Please identify by Docket Number DHS-
2006-0076 to request further information by one of the following
methods:
Mail: Hugo Teufel III, Chief Privacy Officer, Privacy
Office, Department of Homeland Security, Washington, DC 20528.
[[Page 78447]]
Facsimile: 202-572-8727 (not a toll-free number).
E-Mail: privacy@dhs.gov.
SUPPLEMENTARY INFORMATION: As part of its efforts to streamline and
consolidate its record system, the Department of Homeland Security
(DHS) is establishing a new agency-wide systems of records under the
Privacy Act of 1974 (5 U.S.C. 552a) for the Department of Homeland
Security General Information Technology Access Account Records System
(GITAARS). This system of records is part of DHS's ongoing record
integration and management efforts. This system will consist of
information collected in order to provide authorized individuals with
access to DHS information technology resources. This information
includes user name, business affiliation, account information and
passwords.
The Privacy Act embodies fair information principles in a statutory
framework governing the means by which the U.S. Government collects,
maintains, uses and disseminates personally identifiable information.
The Act applies to information that is maintained in a ``system of
records.'' A ``system of records'' is a group of any records under the
control of an agency from which information is retrieved by the name of
an individual or by some identifying number, symbol, or other
identifying particular assigned to the individual. The Privacy Act
requires each agency to publish in the Federal Register a description
of the type and character of each system of records that the agency
maintains, and the routine uses for which such information may be
disseminated and the purpose for which the system is maintained.
Individuals may request their own records that are maintained in a
system of records in the possession or under the control of DHS by
complying with DHS Privacy Act regulations, 6 CFR Part 5.
In accordance with 5 U.S.C. 552a(r), a report on this system has
been sent to Congress and to the Office of Management and Budget.
DHS-2006-0076
System name:
General Information Technology Access Account Records System, DHS/
ALL 004.
Security classification:
Unclassified but sensitive.
System location:
Records are maintained by the Department of Homeland Security at
the DHS Data Center in Washington, DC, and at a limited number of
remote locations where DHS components or program maintain secure
facilities and conducts its mission.
Categories of individuals covered by the system:
A. All persons who are authorized to access DHS Information
Technology resources, including employees, contractors, grantees,
private enterprises and any lawfully designated representative of the
above and including representatives of Federal, state, territorial,
tribal, local, international, or foreign government agencies or
entities, in furtherance of the DHS mission;
B. Individuals who serve on DHS boards and committees;
C. Individuals who have business with DHS and who have provided
personal information in order to facilitate access to DHS Information
Technology resources; and
D. Individuals who are facility points of contact for government
business and the individual(s) they list as emergency contacts.
Categories of records in the system:
DHS/ALL 004 contains names, business affiliations, facility
positions held, business telephone numbers, cellular phone numbers,
pager numbers, numbers where individuals can be reached while on travel
or otherwise away from the office, citizenship, home addresses,
electronic mail addresses, names and phone numbers of other contacts,
the positions or titles of those contacts, their business affiliations
and other contact information provided to the Department that is
derived from other sources to facilitate authorized access to DHS
Information Technology resources.
Authority for maintenance of the system:
5 U.S.C. 301; 44 U.S.C. 3101.
Purpose(s):
This system will collect a discreet set of personal information in
order to provide authorized individuals access to DHS information
technology resources. The information collected by the system will
include full name, user name, account information, citizenship,
business affiliation, contact information, and passwords.
The system enables DHS to maintain: (a) Account information for
gaining access to information technology; (b) lists of individuals who
are appropriate organizational points of contact for the Department;
and (c) lists of individuals who are emergency points of contact. The
system will also enable DHS to provide individuals access to certain
programs and meeting attendance and where appropriate allow for sharing
of information between individuals in the same operational program to
facilitate collaboration.
Routine uses of records maintained in the system, including categories
of users and the purposes of such uses:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, all or a portion of the records or
information contained in this system may be disclosed outside DHS as a
routine use pursuant to 5 U.S.C. 552a(b)(3), limited by privacy impact
assessments, data sharing, or other agreements, as follows:
A. To DHS contractors, consultants or others, when necessary to
perform a function or service related to this system of records for
which they have been engaged. Such recipients are required to comply
with the Privacy Act of 1974, as amended (5 U.S.C. 552a).
B. To sponsors, employers, contractors, facility operators,
grantees, experts, and consultants in connection with establishing an
access account for an individual and when necessary to accomplish a DHS
mission function related to this system of records.
C. To other individuals in the same operational program supported
by an information technology system, where appropriate notice to the
individual has been made that his or her contact information will be
shared with other members of the same operational program in order to
facilitate collaboration.
D. To a Congressional office from the record of an individual in
response to an inquiry from that Congressional office made at the
written or attested to request of the individual to whom the record
pertains.
E. To the National Archives and Records Administration or other
Federal government agencies pursuant to records management inspections
being conducted under the authority of 44 U.S.C. Sections 2904 and
2906.
F. To the Department of Justice (DOJ), or other Federal agency
conducting litigation or in proceedings before any court, adjudicative
or administrative body, when: (a) DHS; (b) any employee of DHS in his/
her official capacity; (c) any employee of DHS in his/her individual
capacity where DOJ or DHS has agreed to represent the employee; or (d)
the United States or any agency thereof, is a party to the litigation
or has an interest in such litigation.
Disclosure to consumer reporting agencies:
None.
[[Page 78448]]
Policies and practices for storing, retrieving, accessing, retaining,
and disposing of records in the system:
Storage
Records in this system are on paper and/or in digital or other
electronic form. Digital and other electronic images are stored on a
storage area network in a secured environment.
Retrievability:
Information may be retrieved by an identification number assigned
by computer, by facility, by business affiliation, e-mails address, or
by the name of the individual.
Safeguards:
Information in this system is safeguarded in accordance with
applicable laws, rules and policies, including the DHS Information
Technology Security Program Handbook. Further, GITAARS security
protocols will meet multiple NIST Security Standards from
Authentication to Certification and Accreditation. Records in the
GITAARS will be maintained in a secure, password protected electronic
system that will utilize security hardware and software to include:
multiple firewalls, active intruder detection, and role-based access
controls. Additional safeguards will vary by component and program. All
records are protected from unauthorized access through appropriate
administrative, physical, and technical safeguards. These safeguards
include: restricting access to authorized personnel who have a ``need
to know;'' using locks; and password protection identification
features. Classified information is appropriately stored in accordance
with applicable requirements. DHS file areas are locked after normal
duty hours and the facilities are protected from the outside by
security personnel.
Retention and disposal:
Records are retained and disposed of in accordance with the
National Archives and Records Administration's General Records Schedule
24, section 6, ``User Identification, Profiles, Authorizations, and
Password Files.'' Inactive records will be destroyed or deleted 6 years
after the user account is terminated or password is altered, or when no
longer needed for investigative or security purposes, whichever is
later.
System manager(s) and address:
For Headquarters components of the Department of Homeland Security,
the System Manager is the Director of Departmental Disclosure, U.S.
Department of Homeland Security, Washington, DC 20528.
For operational components that comprise the U.S. Department of
Homeland Security, the System Managers are as follows:
United States Coast Guard, FOIA Officer/PA System Manager,
Commandant, CG-611, U.S. Coast Guard, 2100 2nd Street, SW., Washington,
DC 20593-0001.
United States Secret Service, FOIA/PA System Manager,
Suite 3000, 950 H Street, NW., Washington, DC 20223.
Under Secretary for Federal Emergency Management
Directorate, FOIA/PA System Manager, 500 C Street, SW., Room 840,
Washington, DC 20472.
Director, Citizenship and Immigration Services, U.S.
Citizenship and Immigration Services, ATTN: Records Services Branch
(FOIA/PA), 111 Massachusetts Ave, NW., 2nd Floor, Washington, DC 20529.
Commissioner, Customs and Border Protection, FOIA/PA
System Manager, Disclosure Law Branch, Office of Regulations & Rulings,
Ronald Reagan Building, 1300 Pennsylvania Avenue, NW., (Mint Annex)
Washington, DC 20229.
Bureau of Immigration and Customs Enforcement, FOIA/PA
System Manager, Office of Investigation, Chester Arthur Building (CAB),
425 I Street, NW., Room 4038, Washington, DC 20538.
Assistant Secretary, Transportation Security
Administration, FOIA/PA System Manager, Office of Security, West
Building, 4th Floor, Room 432-N, TSA-20, 601 South 12th Street,
Arlington, VA 22202-4220.
Federal Protective Service, FOIA/PA System Manager, 1800 F
Street, NW., Suite 2341, Washington, DC 20405.
Federal Law Enforcement Training Center, Disclosure
Officer, 1131 Chapel Crossing Road, Building 94, Glynco, GA 31524.
Under Secretary for Science & Technology, FOIA/PA System
Manager, Washington, DC 20528.
Under Secretary for Preparedness, Nebraska Avenue Complex,
Building 81, 1st floor, Washington, DC 20528.
Director, Operations Coordination, Nebraska Avenue
Complex, Building 3, Washington, DC 20529.
Officer of Intelligence and Analysis, Nebraska Avenue
Complex, Building 19, Washington, DC 20529.
Notification procedure:
To determine whether this system contains records relating to you,
write to the appropriate System Manager(s) identified above.
Record access procedures:
A request for access to records in this system may be made by
writing to the System Manager, identified above, in conformance with 6
CFR Part 5, Subpart B, which provides the rules for requesting access
to Privacy Act records maintained by DHS.
Contesting record procedures:
Same as ``Records Access Procedures'' above.
Record source categories:
Information contained in this system is obtained from affected
individuals/organizations/facilities, public source data, other
government agencies and/or information already in other DHS records
systems.
Exemptions claimed for the system:
None.
Dated: December 18, 2006.
Hugo Teufel III,
Chief Privacy Officer.
[FR Doc. E6-22008 Filed 12-28-06; 8:45 am]
BILLING CODE 4410-10-P