2-Attachment B - CJIS Privacy and Security Addendum and MCA.pdf

MANAGEMENT CONTROL AGREEMENT

REGARDING

TEXAS DEPARTMENT OF PUBLIC SAFETY AND FBI

CRIMINAL JUSTICE INFORMATION SYSTEMS

The purpose of this document is to establish and enforce Security Control of the access and use of the Texas Department of Public Safety’s (DPS) Texas Law Enforcement Telecommunications System and associated DPS, FBI and other systems in a location where access to and/or use of that system is accomplished by a criminal justice agency with the assistance of a non-criminal justice governmental agency. This document places Security Control of that access and use under the authority of the criminal justice agency.

This document is an agreement between the “criminal justice agency,” and, the “non-criminal justice agency” providing services in support of the criminal justice agency in the execution of its duties under the “administration of criminal justice.”

Whereas the non-criminal justice agency manages the associated computer and/or equipment and personnel that provide the criminal justice agencies with access to the Texas Law Enforcement Telecommunications Systems (TLETS), and

Whereas the non-criminal justice agency through the Communications Supervisor performs certain functions of the Texas Crime Information Centers (TCIC) and the National Crime Information Center (NCIC) for the criminal justice agency, and

Whereas the criminal justice agency has signed an agreement with the Texas Department of Public Safety to use and participate in the state’s telecommunications networks and associated systems, and

Whereas the state transmits state and national criminal history information over those networks, and

Whereas the state participates in the FBI CJIS Systems which require that all access to the FBI CJIS Systems be controlled by the FBI CJIS Security Policy, and

Whereas the CJIS Security Policy requires that the State CJIS Systems Agency (The Texas Department of Public Safety) establish “Security Control,” for that access, and

Whereas Security Control is defined as the ability of the CSA or criminal justice agency to set, maintain, and enforce:

1. Standards for the selection, supervision, and termination of personnel; and

2. Policy governing the operation of computers, access devices, circuits, hubs, routers, firewalls, and other components that make up and support a telecommunications network and related CJIS systems used to process, store, or transmit criminal justice information, guaranteeing the priority, integrity, and availability of service needed by the criminal justice community.

Attachment B – CJIS Privacy & Security Addendum / MCA

Management Control Agreement

Whereas the Department of Public Safety defines management control as the authority and responsibility to enforce Security Control as herein defined, Therefore, be it resolved that this agreement hereby places the technical services division under the management control, as herein defined, of the criminal justice agency.

SECURITY

The non-criminal justice agency agrees to abide by all current and hereafter approved rules of the Texas, and National Law Enforcement Telecommunications Systems and of the Texas and National Crime Information Centers (TCIC/NCIC), including but not limited to all requirements of the CJIS Security Policy. The compliance with those requirements shall be determined by the criminal justice agency and

TCIC.

Computers having access to TCIC/NCIC must have the proper software and hardware controls, implemented under the supervision of the criminal justice agency, to prevent criminal history and other TLETS data from being accessible to any terminals other than authorized terminals.

The non-criminal justice agency must allow adequate physical security, as required by the CJIS Security Policy and determined by the criminal justice agency, to protect against any unauthorized personnel gaining access to the terminals, computer equipment or any of the stored data.

Personnel at the criminal justice agency site must be screened thoroughly under the authority and supervision of the criminal justice agency, in accordance with TCIC/NCIC policy. This screening applies to criminal justice and non-criminal justice personnel, including non-criminal justice maintenance and technical personnel. This screening will be done under the guidelines established in the CJIS Security Policy. Decisions by the criminal justice agency related to personnel are limited to the inclusion or exclusion of personnel from the criminal justice agency, according to the guidelines established by the CJIS Security Policy and implemented by TCIC Policy.

All visitors to the criminal justice agency and the technical services division must be accompanied by staff personnel at all times.

All terminals and network equipment having access to the state’s law enforcement networks must be physically placed in secure locations, as required by the CJIS Security Policy and determined by the criminal justice agency.

Access to all terminals and network equipment that protects and/or transmits the criminal justice data must be restricted to the minimum number of authorized employees needed to complete the work.

Printed copies of criminal history data obtained from TCIC or NCIC must be afforded security to prevent any unauthorized access to or use of the data. When the printout is no longer needed, it must be filed in a secure file or destroyed.

No dial-up access will be permitted to a computer or a terminal with access to the state’s law enforcement network unless that dial-up access has been approved by the criminal justice agency and the state.

No terminal will access the state’s law enforcement networks, and no data will be requested or obtained through these networks without the approval of the criminal justice agency.

No changes will be made to the configuration of the networks accessing the state’s law enforcement network without prior approval of the state.

TRAINING

All terminal operators must be trained according to TCIC/NCIC standards.

RECORDS KEEPING

The non-criminal justice agency agrees to allow the implementation of all TCIC/NCIC records keeping rules, including but not limited to:

1. Timeliness of entry/cancellation/clear

2. Quality Assurance of entries

3. Validation of entries

4. Ten Minute/One Hour Hit Confirmation

5. Dissemination of TCIC/NCIC information

6. Logging of criminal history inquiries

7. Use of the system for authorized purposes only

The criminal justice agency through its supervisor will cooperate in the preparation of and following written procedures concerning these and all TCIC/NCIC records keeping requirements. Those procedures will be established, maintained, and followed as determined by the criminal justice agency in accordance with TCIC/NCIC policies.

MONITORING AND AUDITING

The non-criminal justice agency agrees to allow the criminal justice agency and TCIC necessary access, as determined by TCIC and the criminal justice agency, to the physical locations, any computer programs, any computer files, and/or network activities necessary to implement and enforce security control as defined by the CJIS Security Policy. The criminal justice agency in accordance with TCIC/NCIC policy, has the responsibility and authority to monitor, audit and enforce the implementation of this agreement by the non-criminal justice agency.

DPS and FBI audits of the technical services division will be to determine whether policies have been established by the criminal justice agency and implemented by the non criminal justice agency.

GENERAL

The criminal justice agency will not manage the day to day operations of the technical services division, but may establish and enforce the priorities necessary to meet DPS and FBI policies regarding system use.

The non-criminal justice agency agrees to cooperate with the criminal justice agency in the implementation of this agreement, and to accomplish the directives of the criminal justice agency under the provisions of this agreement.

Non-Criminal Justice Agency Criminal Justice Agency

Signature Signature

Printed Name Printed Name

Title Title

Date Date

Signature

Signature

Printed Name

Title Title

Date Date

APPENDIX A

Appropriate environmental security measures would include:

a) A back-up power supply or uninterruptible power source.

b) Environment monitors and controls for temperature, air conditioning, humidity, etc.

c) Emergency lighting.

d) Adequate fire detection/suppression devices.

e) Emergency shutdown of system and/or power devices.

f) Duplicate computer files, if applicable, (as a countermeasure for unauthorized destruction of original files) which are to be maintained off premise. Computer tapes or discs should be locked in a safe (fireproof) storage area under the control of senior agency personnel. Secondary storage (off-site location) will be used to back-up.

APPENDIX B

The standards apply to all Center personnel with access to network systems as defined in Title 28 CFR, Part 20 to CHRI data, including, but not limited to:

a) Management personnel who direct criminal justice related software, hardware, or dispatch functions.

b) Supervisory personnel who supervise criminal justice related software, hardware, or dispatch functions; or have terminal access to criminal justice data either directly or through their subordinates; or who have general responsibility for criminal justice related data storage, switching, transmission and logging.

c) Personnel involved in analysis, evaluation and/or programming of criminal justice related data stored, switches, transmitted or logged by the center.

d) Non-Data processing personnel who regularly provide necessary software or hardware installation, modification or maintenance in the dispatch center.

e) Non-Data Processing personnel who provide temporary and necessary software, hardware or telecommunications installation, modification or maintenance, or such other services as deemed necessary by the Communications Supervisor.

f) All other persons with direct access to the dispatch center or terminals with access to the state’s telecommunications system.

Agency Identification

Agency Name ORI

Agency Address

City Zip

Agency Representative (Title and Name)

Phone Number Fax Number

Email address

Contractor Identification

Company Name Service Providing Agency

Company Address

City State Zip

Contractor Representative (Title and Name)

Phone Number Fax Number

Email address

Visit our website www.dps.texas.gov/securityreview for information on submitting vendor/contractor fingerprints.

Email can be sent to: security.committee@dps.texas.gov

Main office number is: (512) 424-5686

Parties may use the following Security Addendum with the Texas Signatory Page or, in their contract, choose to incorporate the Security Addendum by reference. If the Addendum is incorporated by reference into the contract, a copy of the contract must be provided to the TX DPS CJIS Security Office.

Attachment B – CJIS Privacy & Security Addendum / MCA http://www.dps.texas.gov/securityreview mailto:security.committee@dps.texas.gov

FEDERAL BUREAU OF INVESTIGATION

CRIMINAL JUSTICE INFORMATION SERVICES

SECURITY ADDENDUM

Legal Authority for and Purpose and Genesis of the

Security Addendum

Traditionally, law enforcement and other criminal justice agencies have been responsible for the confidentiality of their information. Accordingly, until mid-1999, the Code of Federal Regulations Title 28, Part 20, subpart C, and the National Crime Information Center (NCIC) policy paper approved December 6, 1982, required that the management and exchange of criminal justice information be performed by a criminal justice agency or, in certain circumstances, by a noncriminal justice agency under the management control of a criminal justice agency.

In light of the increasing desire of governmental agencies to contract with private entities to perform administration of criminal justice functions, the FBI sought and obtained approval from the United States Department of Justice (DOJ) to permit such privatization of traditional law enforcement functions under certain controlled circumstances. In the Federal Register of May 10, 1999, the FBI published a Notice of Proposed Rulemaking, announcing as follows:

1. Access to CHRI [Criminal History Record Information] and

Related Information, Subject to Appropriate Controls, by a Private Contractor Pursuant to a Specific Agreement with an Authorized Governmental Agency To Perform an Administration of Criminal Justice Function (Privatization).

Section 534 of title 28 of the United States Code authorizes the Attorney General to exchange identification, criminal identification, crime, and other records for the official use of authorized officials of the federal government, the states, cities, and penal and other institutions. This statute also provides, however, that such exchanges are subject to cancellation if dissemination is made outside the receiving departments or related agencies. Agencies authorized access to CHRI traditionally have been hesitant to disclose that information, even in furtherance of authorized criminal justice functions, to anyone other than actual agency employees lest such disclosure be viewed as unauthorized. In recent years, however, governmental agencies seeking greater efficiency and economy have become increasingly interested in obtaining support services for the administration of criminal justice from the private sector. With the concurrence of the FBI’s Criminal Justice Information Services (CJIS) Advisory Policy Board, the DOJ has concluded that disclosures to private persons and entities providing support services for criminal justice agencies may, when subject to appropriate controls, properly be viewed as permissible disclosures for purposes of compliance with 28 U.S.C. 534.

We are therefore proposing to revise 28 CFR 20.33(a) (7) to provide express authority for such arrangements. The proposed authority is similar to the authority that already exists in 28 CFR 20.21(b)(3) for state and local CHRI systems. Provision of CHRI under this authority would only be permitted pursuant to a specific agreement with an authorized governmental agency for the purpose of providing services for the administration of criminal justice. The agreement would be required to incorporate a security addendum approved by the Director of the FBI (acting for the Attorney General). The security addendum would specifically authorize access to CHRI, limit the use of the information to the specific purposes for which it is being provided, ensure the security and confidentiality of the information consistent with applicable laws and regulations, provide for sanctions, and contain such other provisions as the Director of the FBI (acting for the Attorney General) may require. The security addendum, buttressed by ongoing audit programs of both the FBI and the sponsoring governmental agency, will provide an appropriate balance between the benefits of privatization, protection of individual privacy interests, and preservation of the security of the FBI’s CHRI systems.

The FBI will develop a security addendum to be made available to interested governmental agencies. We anticipate that the security addendum will include physical and personnel security constraints historically required by NCIC security practices and other programmatic requirements, together with personal integrity and electronic security provisions comparable to those in NCIC User Agreements between the FBI and criminal justice agencies, and in existing Management Control Agreements between criminal justice agencies and noncriminal justice governmental entities. The security addendum will make clear that access to CHRI will be limited to those officers and employees of the private contractor or its subcontractor who require the information to properly perform services for the sponsoring governmental agency, and that the service provider may not access, modify, use, or disseminate such information for inconsistent or unauthorized purposes.

Consistent with such intent, Title 28 of the Code of Federal Regulations (C.F.R.)

was amended to read:

§ 20.33 Dissemination of criminal history record information.

a) Criminal history record information contained in the Interstate

Identification Index (III) System and the Fingerprint Identification Records System (FIRS) may be made available:

1) To criminal justice agencies for criminal justice purposes, which purposes include the screening of employees or applicants for employment hired by criminal justice agencies.

2) To noncriminal justice governmental agencies performing criminal justice dispatching functions or data processing/information services for criminal justice agencies; and

3) To private contractors pursuant to a specific agreement with an agency identified in paragraphs (a)(1) or (a)(6) of this section and for the purpose of providing services for the administration of criminal justice pursuant to that agreement. The agreement must incorporate a security addendum approved by the Attorney General of the United

States, which shall specifically authorize access to criminal history record information, limit the use of the information to the purposes for which it is provided, ensure the security and confidentiality of the information consistent with these regulations, provide for sanctions, and contain such other provisions as the Attorney General may require. The power and authority of the Attorney General hereunder shall be exercised by the FBI Director (or the Director’s designee).

This Security Addendum, appended to and incorporated by reference in a government-private sector contract entered into for such purpose, is intended to insure that the benefits of privatization are not attained with any accompanying degradation in the security of the national system of criminal records accessed by the contracting private party. This Security Addendum addresses both concerns for personal integrity and electronic security which have been addressed in previously executed user agreements and management control agreements.

A government agency may privatize functions traditionally performed by criminal justice agencies (or noncriminal justice agencies acting under a management control agreement), subject to the terms of this Security Addendum. If privatized, access by a private contractor's personnel to NCIC data and other CJIS information is restricted to only that necessary to perform the privatized tasks consistent with the government agency's function and the focus of the contract. If privatized the contractor may not access, modify, use or disseminate such data in any manner not expressly authorized by the government agency in consultation with the FBI.

SECURITY ADDENDUM

The goal of this document is to augment the CJIS Security Policy to ensure adequate security is provided for criminal justice systems while (1)under the control or management of a private entity or (2) connectivity to FBI CJIS Systems has been provided to a private entity (contractor). Adequate security is defined in Office of Management and Budget Circular A- 130 as “security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.”

The intent of this Security Addendum is to require that the Contractor maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

This Security Addendum identifies the duties and responsibilities with respect to the installation and maintenance of adequate internal controls within the contractual relationship so that the security and integrity of the FBI's information resources are not compromised. The security program shall include consideration of personnel security, site security, system security, and data security, and technical security.

The provisions of this Security Addendum apply to all personnel, systems, networks and support facilities supporting and/or acting on behalf of the government agency.

1.00 Definitions

1.01 Contracting Government Agency (CGA) - the government agency, whether a Criminal Justice Agency or a Noncriminal Justice Agency, which enters into an agreement with a private contractor subject to this Security Addendum.

1.02 Contractor - a private business, organization or individual which has entered into an agreement for the administration of criminal justice with a Criminal Justice Agency or a Noncriminal Justice Agency.

2.00 Responsibilities of the Contracting Government Agency.

2.01 The CGA will ensure that each Contractor employee receives a copy of the Security Addendum and the CJIS Security Policy and executes an acknowledgment of such receipt and the contents of the Security Addendum. The signed acknowledgments shall remain in the possession of the CGA and available for audit purposes.

3.00 Responsibilities of the Contractor.

3.01 The Contractor will maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

4.00 Security Violations.

4.01 The CGA must report security violations to the CJIS Systems Officer (CSO) and the Director, FBI, along with indications of actions taken by the CGA and Contractor.

4.02 Security violations can justify termination of the appended agreement.

4.03 Upon notification, the FBI reserves the right to:

a. Investigate or decline to investigate any report of unauthorized use;

b. Suspend or terminate access and services, including telecommunications links.

The FBI will provide the CSO with timely written notice of the suspension.

Access and services will be reinstated only after satisfactory assurances have been provided to the FBI by the CGA and Contractor. Upon termination, the Contractor's records containing CHRI must be deleted or returned to the CGA.

5.00 Audit

5.01 The FBI is authorized to perform a final audit of the Contractor's systems after termination of the Security Addendum.

6.00 Scope and Authority

6.01 This Security Addendum does not confer, grant, or authorize any rights, privileges, or obligations on any persons other than the Contractor, CGA, CJA (where applicable), CSA, and FBI.

6.02 The following documents are incorporated by reference and made part of this agreement: (1) the Security Addendum; (2) the NCIC 2000 Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20. The parties are also subject to applicable federal and state laws and regulations.

6.03 The terms set forth in this document do not constitute the sole understanding by and between the parties hereto; rather they augment the provisions of the CJIS Security Policy to provide a minimum basis for the security of the system and contained information and it is understood that there may be terms and conditions of the appended Agreement which impose more stringent requirements upon the Contractor.

6.04 This Security Addendum may only be modified by the FBI, and may not be modified by the parties to the appended Agreement without the consent of the FBI.

6.05 All notices and correspondence shall be forwarded by First Class mail to:

Assistant Director Criminal Justice Information Services Division, FBI 1000 Custer Hollow Road Clarksburg, West Virginia 26306

SECURITY ADDENDUM

CERTIFICATION

I hereby certify that I am familiar with the contents of (1) the Security Addendum, including its legal authority and purpose; (2) the NCIC 2000 Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20, and agree to be bound by their provisions.

I recognize that criminal history record information and related data, by its very nature, is sensitive and has potential for great harm if misused. I acknowledge that access to criminal history record information and related data is therefore limited to the purpose(s) for which a government agency has entered into the contract incorporating this Security Addendum. I understand that misuse of the system by, among other things: accessing it without authorization; accessing it by exceeding authorization; accessing it for an improper purpose; using, disseminating or re-disseminating information received as a result of this contract for a purpose other than that envisioned by the contract, may subject me to administrative and criminal penalties. I understand that accessing the system for an appropriate purpose and then using, disseminating or re-disseminating the information received for another purpose other than execution of the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend upon whether or not I receive additional compensation for such authorized activity. Such exposure for misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and federal crimes.

Signature of Contractor Employee Date

Printed or Typed Contractor Employee Name

Sex: Race: DOB: State/ID or DL:

Signature of Contractor Representative Date

Printed or Typed Name of Contractor Representative

Organization Name and Representative’s Title

Texas Signatory Page

The undersigned parties agree that the Security Addendum is now a part of the contract between the entities. The parties agree to abide by all requirements of the Security Addendum and the CJIS Security Policy, and it shall remain in force for the term of the contract. Any violation of this addendum constitutes a breach of the contract.

To the extent there is a conflict between a confidentiality clause in the underlying contract and the Security Addendum and/or the CJIS Security Policy, the Security Addendum and the CJIS Security Policy shall govern any information covered by the Security Addendum and/or the CJIS Security Policy.

(To be signed and dated by the vendor(s) and law enforcement agency representative(s) who signed the original contract, or at least who have authority to bind each entity – to include subcontractor services; third party service provider if applicable)

Printed Name of Agency Representative

Signature of Agency Representative Title

Agency Name and ORI Date

Printed Name of Vendor (Contractor) Representative

Signature of Vendor (Contractor) Representative Title

Vendor Organization Name Date

Printed Name of Vendor (Sub-Contractor) Representative

Signature of Vendor (Sub-Contractor) Representative Title

Vendor Organization Name Date