Department of Justice/Federal Bureau of Investigation

Privacy Impact Assessment (PIA)
for the
Federal Bureau of Investigation
Fingerprint Identification Records System (FIRS)
Integrated Automated Fingerprint Identification System (IAFIS)
Outsourcing for Noncriminal Justice Purposes - Channeling

May 5, 2008

Contact Point
Barbara S. Wiles
Programs Support Section
FBI CJIS Division
Module B-3
Phone: (304) 625-2748

 Approving Official
Kenneth P. Mortensen
Acting Chief Privacy and Civil Liberties Officer
Department of Justice
(202) 514-0049

Section 1.0  The System and the Information Collected and Stored within the System.
            The following questions are intended to define the scope of the information in the system, specifically the nature of the information and the sources from which it is obtained.
            1.1       What information is to be collected?
            Information collected and disseminated is CHRI.  (See "Definition of CHRI" at page 2 above).
            No additional information is being collected; instead, this initiative involves changes in the way fingerprint submissions are provided to the CJIS Division (by pre-approved channelers) and the way results of criminal history record checks are provided to authorized recipients electing to use this process.
            1.2       From whom is the information collected?
            Fingerprints, associated descriptive data, and arrest cycles are submitted to the FBI by Federal, State, local, tribal, and some foreign law enforcement agencies, which are maintained by the CJIS Division and considered to be CHRI.
            For noncriminal justice purposes, fingerprints are collected from individuals undergoing noncriminal justice criminal history record checks identified in Section 2.1.  The noncriminal justice fingerprint submissions are compared against the fingerprints maintained in the FIRS to determine whether there are matches.  Results of these comparisons are returned to authorized recipients as permitted by statute, executive order, or regulation or order of the Attorney General of the United States.  This initiative does not expand the categories of individuals from whom fingerprints may be submitted to or maintained by the FBI CJIS Division.
            Currently, fingerprints are obtained and forwarded to the authorized recipient, who in turn forward the fingerprints to the FBI for a national criminal history background check.  Under this initiative, authorized recipients may elect to use pre-approved channelers to electronically submit fingerprints to the CJIS Division.
Section 2.0      The Purpose of the System and the Information Collected and Stored within the System.
            The following questions are intended to delineate clearly the purpose for which information is collected in the system.
            2.1       Why is the information being collected?
            Individuals applying for noncriminal justice benefits (e.g., employment, licensing) are sometimes required to submit fingerprints to the FBI for criminal history record checks when authorized by Federal statute, State statute pursuant to Public Law 92-544, 86 Stat. 1115, Presidential Executive Order, or regulation of the United States Attorney General.  (See 28 CFR 20.31 (b)).  The FBI compares the fingerprints against FBI-maintained criminal history identification records and appropriate responses are provided to authorized recipients.  (E.g., "no record found" or the applicable "rap sheets").
            2.2       What specific legal authorities, arrangements, and/or agreements authorize the collection of information?
            The underlying authorities for the FIRS and NCIC include the broad general authority of 28 U.S.C. § 534 and 42 U.S.C.§ 14616.   In addition, numerous Federal and State statutes provide specific authorities for particular types of matters.           
            2.3       Privacy Impact Analysis: Given the amount and type of information collected, as well as the purpose, discuss what privacy risks were identified and how they were mitigated.
            Although individual arrest cycles are generally available to the public at police stations or courthouses, the CHRI being provided to authorized recipients via channelers is nonetheless considered to be sensitive information warranting appropriate protection.  The CHRI maintained by the CJIS Division is more sensitive because it is a compilation of data from many sources.  (See U.S. DOJ v. Reporters Committee For Freedom of the Press, 489 U.S. 749 (1989).)
            FIRS has been in existence for decades, initially collecting criminal fingerprints and later collecting civil fingerprints as described in the September 28, 1999, SORN.   To mitigate privacy risks, the CJIS Division has quality control standards in place to ensure accuracy of information, individuals are authorized to access their records for review and correction, and the CJIS Division has established an audit unit that is tasked with checking a representative sample of contractors and authorized recipients on a triennial basis.  Additionally, both the CJIS Advisory Policy Board (APB) and the Compact Council have Sanction Committees to address alleged misuse of FIRS.  Lastly, individuals contact the CJIS Division on occasion to allege misuse of Federal records by governmental agencies.  These allegations are generally referred to the appropriate CJIS Systems Officer and the FBI responds to all such allegations.
            The Compact Council promulgated a Final Rule for Outsourcing of Noncriminal Justice Administrative Functions on December 15, 2005. The Final Rule and Outsourcing Standard were published on December 15, 2005 (70 FR 74200; 70 FR 74373).
            Although channelers have the potential for collecting and disseminating the results of criminal history record checks to other than authorized recipients, each contractor has agreed to abide by the Outsourcing Standard.  This Outsourcing Standard's written goal is to "provide adequate security and integrity for CHRI while under the control or management of an outsourced third party" (e.g., channeler).  To achieve this result, each pre-approved channeler has agreed to, inter alia, enter into a CJIS WAN Memorandum of Understanding (MOU), and  comply with the CJIS Security Policy, which is incorporated by reference into the Outsourcing Standard.
            Channelers are subject to announced and unannounced audits to discover violations of contract provisions, CJIS Security Policy, and the Compact Council's approved Outsourcing Standard.  Violations can result in contract termination for channelers and access termination for other authorized recipients.
            Prior to engaging in outsourcing, the authorized recipient shall: (a) Request and receive written permission from the appropriate Compact Officer; (b) provide the Compact Officer copies  of the specific authority for the outsourced work, criminal history record check requirements, and/or a copy of the contract as requested; and (c) inquire of the FBI Compact Officer whether a prospective Contractor has any security violations.
            The Compact Officer/Chief Administrator may not grant the authorized recipient permission to outsource unless there is an audit program in place to audit a representative sample of Contractors and authorized recipients within one year of contract execution and thereafter on a triennial basis.
Section 3.0  Uses of the System and the Information.
            The following questions are intended to clearly delineate the intended uses of the information in the system.
            3.1       Describe all uses of the information.
            CHRI is used for both criminal and noncriminal justice purposes.  There will be no new uses of the information pursuant to this initiative; however, information currently being provided to thousands of authorized recipients through the United States mail or electronically through governmental entities having CJIS Systems User Agreements with the FBI will now be provided electronically via an FBI pre-approved channeler when there are contracts in place that incorporate the "Outsourcing Standard" by reference.  The channeler is responsible for ensuring that applicable authorized recipients receive the results of criminal history record checks in an expeditious manner.
            3.2       Does the system analyze data to assist users in identifying previously unknown areas of note, concern, or pattern?  (Sometimes referred to as data mining.)
            No.  Civil fingerprint submissions are compared to fingerprints contained in FIRS to determine whether the subject has an existing record.  This system of records has been in existence for decades.
            3.3       How will the information collected from individuals or derived from the system, including the system itself, be checked for accuracy?
            The CJIS Division Audit Unit regularly checks a representative sample of Federal, State, local, and nongovernmental authorized recipients to ensure only authorized fingerprint submissions have been forwarded to the CJIS Division for criminal history record checks.  The authorized recipient is responsible to ensure accurate and complete biographical information is included on these submissions and the fingerprints must be of sufficient quality or they will be rejected by the system.  This initiative contractually requires the channeler to "ensure fingerprint submissions are properly and adequately completed" prior to submission to the FBI.  Authorized recipients are allowed to resubmit fingerprints that are determined to be of insufficient quality at no additional expense.
            3.4       What is the retention period for the data in the system?  Has the applicable retention schedule been approved by the National Archives and Records Administration (NARA)?
            NARA has determined that civil fingerprint submissions are to be destroyed when the  individual reaches 75 years of age and criminal fingerprints are to be destroyed when the individual reaches 99 years of age.

            3.5   Privacy Impact Analysis:  Describe any types of controls that may be in place to ensure that information is handled in accordance with the above described uses. 
            The FIRS SORN, (See Footnote 3 of the PIA) provides the policies and practices for obtaining, storing, retrieving, accessing, retaining, and disposing of records in the FIRS, which is not being affected by this initiative.  The SORN prescribes the retention period for the data in the system (See Section 3.4 of the PIA), which is not being affected by this initiative.
            As noted in Section I‑3 of the PIA, the Outsourcing of Noncriminal Justice Administrative Functions Final Rule specifically limits the use of criminal history record check results to the purpose for which it was provided, and such results are provided to channelers merely for dissemination to authorized recipients.  In essence, a channeler is an "expediter" rather than a user of criminal history record check results.
            Sections H.3.1 and H.3.2.7 of the RFP requires channelers to have a fingerprint‑based criminal history record check conducted on each employee having direct access to CHRI prior to access to FBI CJIS systems, unless escorted by authorized personnel at all times.
            Sections 3.3 and 4.4 of this PIA discuss the CJIS Division Audit Unit requirements for the channelers, noting that random audits are conducted to ensure authorized recipients are complying with the terms of the agreements.  Also featured in Section 5.6 of the PIA, channelers are subject to announced and unannounced audits by authorized recipients, the State, or the FBI.  Section 8.5 of the PIA discusses the established auditing procedures that are in place.
            Section 5.1 of the PIA requires that all contracts between channelers and authorized recipients incorporate by reference the Outsourcing Standard.  In Section 5.4 of the PIA, a channeler must comply with (1) contract provisions, (2) the Compact Council's approved Outsourcing Standard, and (3) the CJIS Security Policy.  Section 4.2.4.2 of the RFP provides that the Contractor shall ensure that each employee performing work under the contract is aware of the requirements of the Outsourcing Standard and the state and Federal laws governing the security and integrity of CHRI.  The Contractor shall confirm that each employee understands the Outsourcing Standard requirements and laws that apply to his/her responsibilities.  A non‑disclosure certificate must also be signed by each employee working under this initiative.
            Section 5.7 of the PIA identifies sanctions that could be imposed upon a channeler for violating the terms of the contract.
            Section I‑3, footnote 7 of the PIA, cites the Congressional authority that is provided to the Compact Council, to include "the authority to promulgate rules and procedures governing the use of the III System...."  Also under Section I‑3 of the PIA, an authorized recipient must first contract with an FBI pre‑approved channeler that has provided a written proposal containing assurances that it will comply with privacy and security considerations mandated by the Compact Council.  Section 8.8 of this PIA notes that the channelers will be subject to the security standards established by the Compact Council.
            As provided in Section 6.4 of the PIA, channelers must comply with the contract, Outsourcing Standard, and the CJIS Security Policy.  The Outsourcing Standard:  (1) identifies the duties and responsibilities with respect to adequate internal controls within the contractual relationship so that the security and integrity of the III System and CHRI are not compromised; (2) outlines site security, dissemination restrictions, personnel security, system security, and data security; and (3) limits the use of the information to the purposes for which provided, ensures the confidentiality of the information, and provides for training, audits, and sanctions for violating the terms of the contract to include contract termination.
Section 4.0  Internal Sharing and Disclosure of Information within the System.
            The following questions are intended to define the scope of sharing both within the Department of Justice and with other recipients.
            4.1       With which internal components of the Department is the information shared?
            All Departmental components have access to this information for all official criminal justice and noncriminal justice purposes.
            4.2       For each recipient component or office, what information is shared and for what purpose?
            The results of criminal history record checks conducted for authorized noncriminal justice purposes pursuant to a positive (fingerprint) match against FIRS data is provided to the relevant authorized recipient.  The data may be accessed via name-based checks for criminal justice purposes, which is not part of this initiative.
            4.3       How is the information transmitted or disclosed?
            The results of most checks are returned to Departmental components electronically; however, check results could be mailed.
            4.4       Privacy Impact Analysis: Given the internal sharing, discuss what privacy risks were identified and how they were mitigated.
            All DOJ components must have access to CHRI in order to perform their official duties.  However, to prevent unauthorized access for noncriminal justice purposes, the component must obtain and submit the subject's fingerprints.
            Additionally, those components receiving criminal history record check results electronically must have a CJIS Systems User Agreement        "Audit - Each agency shall be responsible for complying with all audit requirements for CJIS Systems.  Each CSO is responsible for completing a triennial audit of all agencies with access to CJIS Systems through the CSO's lines." in place prior to record dissemination.  Random audits are conducted to ensure authorized recipients are complying with the terms of those agreements.  The particular statute, Federal executive order, or Attorney General order identifies the class of authorized recipients.
            We do not anticipate that channelers will be used by DOJ components.  However, if channelers should, at some time, be used by DOJ components, the process would be subject to risks and mitigations comparable to those described below.
Section 5.0      External Sharing and Disclosure.
            The following questions are intended to define the content, scope, and authority for information sharing external to DOJ which includes foreign, Federal, State and local government, and the private sector.
            5.1       With which external (non-DOJ) recipient(s) is the information shared?
            The information is shared with thousands of government and private authorized recipients and will be provided to pre-approved channelers which have contracts with authorized recipients.  The contract must incorporate the Outsourcing Standard by reference.  The results of fingerprint-based criminal history record checks are provided to channelers pursuant to the above referenced Solicitation and subsequent contract for the sole purpose of forwarding criminal history record check results to applicable authorized recipients.
            5.2       What information is shared and for what purpose?
            Criminal history record check results are shared with criminal justice agencies for criminal justice purposes and with authorized recipients for noncriminal justice purposes as authorized by statute, executive order, or regulation.  (See Section 2.1).
            The channeling effort does not increase the number of authorized recipients; instead, authorized recipients will have the option of using channelers to electronically submit fingerprints to the CJIS Division for authorized noncriminal justice purposes and to receive the results of authorized criminal history record checks electronically via the channeler.
            5.3       How is the information transmitted or disclosed?
            Currently, the results of most checks are returned electronically; however, checks are sometimes mailed.  Under this initiative, channelers will receive the results electronically.
            5.4       Are there any agreements concerning the security and privacy of the data once it is shared?
            Yes.  Authorized recipients with electronic connectivity must sign CJIS Systems User Agreements and, if a channeler is involved, the channeler must comply with (1) contract provisions, (2) the Compact Council's approved Outsourcing Standard, and (3) the CJIS Security Policy.
            5.5       What type of training is required for users from agencies outside DOJ prior to receiving access to the information?
            Channelers must comply with training requirements contained at 3.03 and 3.05 of the  Outsourcing Standard.  (See Attachment 4).
            5.6       Are there any provisions in place for auditing the recipients’ use of the information?
            Yes,  channelers are subject to announced and unannounced audits by authorized recipients, the State, or the FBI.
            5.7       Privacy Impact Analysis: Given the external sharing, what privacy risks were identified and describe how they were mitigated.
            The identified privacy risk is that a channeler may violate the terms of the contract,  Outsourcing Standard, and/or the CJIS Security Policy.  Accordingly, the channeler is subject to announced and unannounced audits by applicable authorized recipients, State auditors, and FBI auditors.  Sanctions for violating the terms of the contract include contract termination.  In addition, the Privacy Act provides criminal sanctions for anyone who knowingly and willfully requests or obtains any record concerning an individual from a Federal agency under false pretenses.  (5 U.S.C. § 552a(i).)
Section 6.0  Notice
            The following questions are directed at notice to the individual of the scope of information collected, the opportunity to consent to uses of said information, and the opportunity to decline to provide information.
            6.1       Was any form of notice provided to the individual prior to collection of information?  If yes, please provide a copy of the notice as an appendix. (A notice may include a posted privacy policy, a Privacy Act notice on forms, or a system of records notice published in the Federal Register Notice.) If notice was not provided, why not?
            The FIRS SORN was last published September 28, 1999.   Additionally, the Compact Council published the  Interim Final Rule on December 16, 2004 (69 FR 75243) which provided a comment period.  The Final Rule was published on December 15, 2005 (70 FR 74200).  The FBI also published in the Federal Register a notice of its intent to publish a RFP for those parties interested in becoming a channeler.  (See Attachment 5).  The public was informed that channelers would be used as conduits between authorized recipients and the FBI's CJIS Division and there were no comments objecting to the use of channelers.
            6.2       Do individuals have an opportunity and/or right to decline to provide information?
            Individuals do not have the opportunity and/or right to decline to provide the underlying CHRI information, since this is obtained from criminal justice subjects incident to criminal justice processes.
            However, individuals generally do have the opportunity and/or right to decline to provide their fingerprints for noncriminal justice purposes, since the individuals generally may opt to not pursue a noncriminal justice activity which requires a fingerprint check.  Individuals who chose to engage in such a noncriminal justice activity do not have an option and/or right to object to the use of channelers for processing the fingerprint checks.
            The use of channelers is left solely to the discretion of the authorized recipients.  This initiative merely permits electronic submission of fingerprints to the FBI and the return of criminal history record checks via a pre-approved channeler when there is a contractual relationship between the channeler and the authorized recipient that incorporates the Outsourcing Standard by reference.
            6.3       Do individuals have an opportunity to consent to particular uses of the information, and if so, what is the procedure by which an individual would provide such consent?
            Individuals do not have the opportunity and/or right to consent to particular uses of the underlying CHRI information, since this is obtained from criminal justice subjects incident to criminal justice processes.  However, any such uses must comply with the provisions of any applicable law, including the Privacy Act.
            Authorization to collect fingerprint submissions for noncriminal justice purposes is contained in various statutes, Federal executive orders, and regulations.  The primary use for such submissions is to check them against CHRI.  Individuals generally do have the opportunity and/or right to decline to undergo such a check, since the individuals generally may opt to not pursue the noncriminal justice activity which requires the fingerprint check.  Individuals generally do not have the opportunity and/or right to consent to subsequent uses of information provided in noncriminal justice checks.  However, any such uses must comply with the provisions of any applicable law, including the Privacy Act.  Fingerprint submissions retained in FIRS are available for subsequent purposes as authorized by Federal statute, regulation, or other authority, and the public is provided notice of such uses via the FIRS Privacy Act system of records notices.  Individuals thus generally do have the opportunity and/or right to preclude such subsequent uses of their noncriminal justice information, since the individuals generally may opt to not pursue the noncriminal justice activity which requires the fingerprint check.

            6.4       Privacy Impact Analysis: Given the notice provided to individuals above, describe what privacy risks were identified and how you mitigated them.
            All authorized recipients are subject to provisions contained in the CJIS Security Policy, specific provisions in the CJIS Systems User Agreement, and are subject to access termination for violations of those provisions that are discovered during announced and unannounced audits.  As noted in Section 6.1, there were no objections to the potential use of channelers as published in the Federal Register.  Channelers must also comply with the contract, Outsourcing Standard, and the CJIS Security Policy which includes audits and sanctions for violating the terms of the contract which includes contract termination.
Section 7.0  Individual Access and Redress
            The following questions concern an individual’s ability to ensure the accuracy of the information collected about him/her.
            7.1       What are the procedures which allow individuals the opportunity to seek access to or redress of their own information?
            Individuals may access CHRI in FIRS by complying with the provisions of 28 CFR § 16.30 - 16.34 and 28 CFR § 50.12.
            7.2       How are individuals notified of the procedures for seeking access to or amendment of their information?
            See 7.1. above.  Additionally, the FBI responds to written and verbal requests for such procedures.
            7.3       If no opportunity to seek amendment is provided, are any other redress alternatives available to the individual?
            As provided above, there are procedures in place to allow review and correction of FIRS data.
            7.4       Privacy Impact Analysis: Discuss any opportunities or procedures by which an individual can contest information contained in this system or actions taken as a result of agency reliance on information in the system.
            Such procedures are fully covered in the regulations referenced above at 7.1.  Additionally, individuals are encouraged to contact the entering agency to resolve any questions relating to complete, current, and accurate data.

Section 8.0  Technical Access and Security
The following questions are intended to describe technical safeguards and security measures.
            8.1.      Which user group(s) will have access to the system?
            Currently, authorized officials of the Federal Government, including the United States Sentencing Commission, the States, cities, and penal and other institutions may have access to the underlying information in FIRS for criminal justice purposes.  Federal, State, local, and tribal agencies and private entities have access to the underlying information in FIRS for  noncriminal justice purposes such as employment and licensing where authorized by Federal statute, State statute pursuant to Public Law 92-544, executive order, or regulation or order of the United States Attorney General.  See 6.1 for additional references.  This PIA does not change such access by the FIRS underlying users.  The only new access encompassed by this PIA will be the limited access by channelers as described herein.
            8.2       Will contractors to the Department have access to the system? If so, please submit a copy of the contract describing their role with this PIA.
            Yes.  Department support contractors and support contractors from other criminal justice agencies may have access to the underlying system, and in addition, access may be provided to contractors to whom criminal justice administrative services have been outsourced.   (Also see footnotes 9 and 13.)  These grandfathered contractors are not encompassed by the PIA.
            The channelers encompasses by this PIA are not contractors to the Department, but instead will be contractors to the authorized users who choose to utilize them.  However, the FBI has approved the channelers based upon requirements established by the FBI.  These requirements are contained in RFP #06212005, released June 29, 2006.  (See Attachment 1.)
            8.3       Does the system use “roles” to assign privileges to users of the system?
            Yes.  The system is not available to users unless there has been an application for, and assignment of, an Originating Agency Identifier (ORI) Number unique to each using entity.  Each using entity may only access the types of information for the purposes as have been authorized for its ORI.  Such access is strictly controlled and audited by the CJIS Division.
            8.4       What procedures are in place to determine which users may access the system.
            The applicable CJIS System Officer or appropriate FBI official must document each request for an ORI and reference the statute, regulation, or order that authorizes such access.

            8.5       How are the actual assignments of roles and rules verified according to established security and auditing procedures?
            On-site audits of channelers and a representative sample of all authorized recipients are performed by the CJIS audit staff, at a minimum, triennially.  Additional audits may be performed if there are reasons to believe channelers or authorized recipients are not complying with applicable rules and standards.
            8.6       What auditing measures and technical safeguards are in place to prevent misuse of data?
            See 8.5 above.  Additionally, recipients of electronic data from the FBI must have their equipment configured by the FBI to protect the security of the data before such data is transferred.
            8.7       Describe what privacy training is provided to users either generally or specifically relevant to the functionality of the program or system?
            The CJIS Systems User Agreement, the CJIS Security Policy , and the Security and Management Control Outsourcing Standard   mandate such training.   Verification is available via the triennial audits referenced above.
            8.8       Is the data secured in accordance with FISMA requirements?  If yes, when was Certification & Accreditation last completed?
            Yes.  IAFIS was certified and accredited on October 29, 2006.  Channelers processing this  information will occur outside the IAFIS system.  However, the channelers will be subject to the security standards established by the Compact Council.
            8.9       Privacy Impact Analysis: Given access and security controls, what privacy risks were identified and describe how they were mitigated?
            See Section 2.3 above.
Section 9.0  Technology
            The following questions are directed at critically analyzing the selection process for any technologies utilized by the system, including system hardware, RFID, biometrics and other technology.
            9.1       Were competing technologies evaluated to assess and compare their ability to effectively achieve system goals?
            Yes.  System functional and security requirements are pre-established by the FBI prior to the introduction of new technologies.  Functional system requirements are derived from end user needs, applicable laws, and established policy and/or guidelines.  These requirements may be part of the Certification and Accreditation process.
            9.2       Describe how data integrity, privacy, and security were analyzed as part of the decisions made for your system.
            The FIRS system was established several decades ago, preceding the Privacy Act of 1974 and implementation of Privacy Impact Assessments as established during the last decade.  Accordingly, many of these considerations have been lost due to the passage of time.  However, the Certification and Accreditation Process, periodic audits, sanctions for misuse, and input from the CJIS APB substantiate the completeness of data integrity, privacy, and security issues.  The CJIS Security Policy, Compact Council approved Outsourcing Standard, and contract provisions are used in concert to ensure full compliance with Privacy Act requirements and Department of Justice policies.
9.3       What design choices were made to enhance privacy?
            Implementing an "ORI" process, retaining the right to configure communication equipment prior to electronic data transfer, establishing a triennial audit methodology, and providing for access/contract termination for violation of applicable statutes, rules, and procedures are used to enhance privacy.

Conclusion  The concluding section should inform the reader, in summary fashion, how you constructed your system, program, rule, or technology based on privacy risks and mitigation strategies.
            Fingerprints are currently submitted to the FBI for noncriminal justice purposes by mail and electronically via the CJIS WAN; however, the results of such CHRI checks must be returned by mail unless a WAN connection has been established.  It would be economically impractical to establish such connections with every authorized recipient; accordingly, the Compact Council published a Rule that will allow authorized recipients to contract with an FBI-approved channeler to electronically submit fingerprints to the FBI and to receive the results of the fingerprint checks electronically for return to the authorized recipient.  This procedure will utilize existing technology to save money and drastically improve processing time while protecting CHRI.
            The preapproval of channelers will expedite receipt of criminal history record checks by authorized recipients.  This initiative does not include the addition of records in FIRS, it does not increase the number of authorized recipients, and it does not authorize additional criminal history record checks for noncriminal justice purposes.  Instead, this initiative merely utilizes existing technical abilities to ensure fingerprint-supported Federal record checks are provided to authorized recipients in a more timely fashion if the authorized recipients want to take advantage of the process by contracting with FBI pre-approved channelers.
            Audits will regularly check to ensure channelers are complying with the CJIS Security Policy, the Outsourcing Standard, the contract, and an MOU with the CJIS Division.  Violations of any provisions, policies or other outsourcing related documents can lead to termination of the contract.

Responsible Officials/Signatures

_____/s/_________________________         6/15/07
Barbara Wiles                                                  Date
Project Manager
CJIS Division
FBI
DOJ

Approval Signature Page

___/s/___________________________         6/22/2007
David C. Larson for Patrick W. Kelley Date
Deputy General Counsel and
FBI Privacy and Civil Liberties Officer

____/s/_________________________           5/5/2008
Kenneth P. Mortensen                                      Date
Acting Chief Privacy and Civil Liberties Officer
Department of Justice