FY24-Minimally-Viable-Product.pdf

FY24 – CJIS Division Strategy (CDS) #84 Unified CJIS Experience Prototype

Minimally Viable Product

Prepared By:

Criminal Justice Information Services Division (CJIS) Information Technology Management Section (ITMS)

December 14, 2023

Version 1.0

U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division

pg. 2

Contents

1. Overview

2. Data Requirements

3. Prototype Security Requirements

3.1 Authentication Requirements

3.2 Data Dissemination Controls

3.3 Data Transmission Controls

4. CJIS Business Capabilities

5. Business Capability: Public Safety Services

5.2 Background Checks

5.2.1 Name-Based Background Checks

5.2.2 - Firearms Background Checks

5.3 Biographic Public Safety Search (tactical)

5.4 RapBack Service

6. Business Capability: Investigative Services

6.1 CJIS Biographic Investigative Search

6.2 Query Person Information (QPI/QPIR) <future capability>

6.3 Query Wanted + Criminal History Search (QWI)

5.2 CJIS Alert Service (CAS/CASN)

7. Business Capability: Crime Reporting

8. Business Capability: Data Management Services

8.1 Want Management

8.2 Incident Repository Management

8.3 NICS Indices Management (Firearm Prohibitors)

7.4 NIBRS Data Management

9. Business Capability: Collaboration Services

10. Conclusion

pg. 3

pg. 4

1. Overview The Federal Bureau of Investigation (FBI), Criminal Justice Information Services (CJIS) Division provides access to multiple independent systems by requiring users to access each system individually via different user interfaces. These separate disparate interfaces do not provide users with a unified and integrated CJIS experience. Instead, they require users to obtain multiple permissions for access to many different web pages for each CJIS system to find all information relevant to their case, investigation, or event. This less-than-optimal experience introduces inefficiencies for users and makes it difficult to obtain a complete situational awareness of an evolving event.

To address the usability issues, the FBI CJIS Division has established a strategic initiative to explore solutions to improve the user experience. The FY24 initiative incorporates work to (1) collaborate with representatives from the criminal justice community and (2) create a prototype experience to serve as the mechanism for recording and refining user requirements.

The objective of this document is to describe the set of minimally viable features for inclusion into the concept exploration prototype for FY24. For purposes of this document, we will refer to the concept exploration prototype as the CJIS 360 prototype or the C360 prototype for short.

The features described within this document will be built into the initial versions of the C360 prototype.

Once established, the FBI CJIS Division will work with a select group of beta testers to review and refine the capabilities for future revisions.

2. Data Requirements All prototype functions will be for demonstration purposes only and will use synthetic data created by the contractor. The FBI CJIS Division will provide guidance on various CJIS data sets to ensure that capabilities represented within the C360 prototype are representative of the data sets used by CJIS systems.

3. Prototype Security Requirements Security considerations will be in place for user authentication and information dissemination while building the prototype. User interactions detailed in the prototype will consider user attributes required for access and dissemination of information from CJIS services.

3.1 Authentication Requirements

The C360 prototype will be operated and managed by the contractor and will use mock-up data fabricated for demonstration capability. The C360 user accounts and multi-factor authentication will be managed by the contractor.

The C360 prototype should support major authentication standards such as Security Assertion Markup Language (SAML) and oAuth. This capability will enable users to test the “new interface” via the Law Enforcement Enterprise Portal (LEEP). The government will be provide SAML specifications to the contractor to enable the C360 to become a Service Provider accessible via LEEP.

pg. 5

3.2 Data Dissemination Controls

The C360 controls for data dissemination will be based on user attributes to determine the type of data that can be disseminated to the authorized party. The dissemination logic for CJIS data relies on (1) ORI number, (2) sworn law enforcement officer status, and (3) reason for request (purpose codes). To properly explore a user experience, all APIs and user interfaces will need to consider these user attributes when processing requests. The C360 prototype will use these user attributes to determine what data the requesting party is authorized to receive as part of the response.

3.3 Data Transmission Controls

The C360 controls for data transmission will be based on user attributes to define who is authorized to transmit data. The controls for data transmission will rely on ORI number. Authorized users will have the capability to manage specified CJIS data sets.

4. CJIS Business Capabilities The C360 prototype will implement a subset of CJIS business capabilities to demonstrate the envisioned experience. The diagram below can be used as a reference to understand CJIS core business capabilities.

Figure 1: FBI CJIS Division - Core Business Capabilities

pg. 6

5. Business Capability: Public Safety Services Public Safety Services are essential in providing information to federal, state, or local government agencies, which have an extensive portfolio of responsibilities. To further advance the public safety mission, the FBI CJIS Division is working to create a more unified cohesive user experience.

5.1 Electronic Tip Submission

The C360 will provide all users with the capability to submit an electronic tip to report federal crimes or terrorist activity.

5.2 Background Checks

The FBI CJIS Division provides information on subjects for a multitude of reasons, such as special event situations, firearms request, and non-criminal justice purposes. The C360 will provide users with the capability to initiate and perform these requests, as well as provide access controls for usage.

5.2.1 Name-Based Background Checks

The FBI CJIS Division works with partner agencies and organizations to conduct name-based background checks for individuals supporting special events. CJIS performs the intake for these checks, but results are usually submitted back to the agency from the local FBI field office. The C360 prototype should provide the ability for partner agencies to submit these name-based checks to be processed asynchronously.

5.2.2 - Firearms Background Checks The C360 will provide Federal Firearms Licenses (FFLs) access to conduct firearms background checks.

The FFL user will enter information provided by the firearms purchaser on the ATF 4473 form. Upon submission, the FFL will receive a NICS Transaction Number (NTN) which can be used to check the status of their transaction.

Note that the functionality here should be restricted to functions offered to the FFL community and does not include any internal NICS user interfaces intended for use by FBI employees and contractors to process background checks.

Note that while FFLs have traditionally only had access to perform firearms checks, they will need access to the NCIC gun file in the future. This is

5.2.3 - Non-Criminal Justice Background Checks

5.3 Biographic Public Safety Search (tactical)

The C360 prototype will allow users to conduct a biographic public safety search for tactical purposes.

The user will enter name, date of birth, and any identification numbers (SSN, DL#, etc) and will return information from CJIS Division information holdings.

pg. 7

Note that all tactical biographic searches enter CJIS from the user’s state system. Therefore, and C360 direct user interaction should send a message to the user’s state system, which will forward it onto NCIC for processing. Upon processing, the state system will be return results to the user’s C360 experience.

5.4 RapBack Service

The C360 will provide users with the capability to enroll to receive continuous electronic notifications on applicants, employees, volunteers, or licensees who engage in any criminal activity where fingerprints were taken and submitted.

6. Business Capability: Investigative Services Investigative services help investigators and analysts discover and research leads. At CJIS, investigative services allow users to conduct searches (biographic and biometric) to find related information. They also allow data to “find the user” when the systems observe data that is likely of interest to a known user.

While CJIS offers many investigative services, the following subset should be available within the C360 prototype MVP.

6.1 CJIS Biographic Investigative Search

The biographic investigative search is a set of search transactions that are designed to help authorized users develop leads. Users provide biographic information such as name, date of birth, and miscellaneous identifiers to the inquiries and receive back a list of candidates for review and further research.

6.2 Query Person Information (QPI/QPIR) <future capability>

The C360 prototype will explore a new capability for querying CJIS repositories for biographic information. For purposes of this document, the capability will be referred to as the Query Person Information (QPI).

The Query Person Information (QPI) message is an extensive investigative search of multiple CJIS repositories. It is an asynchronous transaction with a 24-hour response time. Upon completion, it results in a Query Person Information Response (QPIR) transaction being return to the user.

Inputs: The QPI request message includes information about a person of interest. The message includes biographic information such as name, date of birth, and ID numbers. The message can include known aliases.

Repositories: The QPI request message includes the repositories that the user wishes to search. For purposes of the demo, the user should be able to select from the following list of CJIS repositories. Note that the user can enter multiple values for the NDR field.

1. All

2. Wanted Person File

3. National Sex Offender Registry

4. NICS Denied Transaction File

5. Violent Person File

pg. 8

6. N-DEx Integrated Person Entity Repository

7. Interstate Identification Index (III) File

Processing: The QPI transaction arrives at NCIC via the user’s state switch. Therefore, if a user is accessing a user interface on the C360 prototype, the system should submit the QPI message to the user’s state system for processing. This can be simulated for purposes of the prototype effort.

Results: Upon completion the user’s state system will send the resulting QPIR message back to the C360 system for presentation to the user.

6.3 Query Wanted + Criminal History Search (QWI)

The QWI message is an investigative message sent to the NCIC from a state system. The inquiry message will query all NCIC person files and spawn a criminal history inquiry to the III. The inquiry results in two response messages. One from NCIC and one from III.

QWI messages must traverse the state system that is connected to NCIC. Therefore, when users of the C360 environment issue QWI transactions, the C360 environment must transmit the message to the user’s state system for processing. If approved for processing, the state system will forward the message onto NCIC.

5.2 CJIS Alert Service (CAS/CASN)

Much like the investigative search, the CJIS alert service notifies investigators when information of interest is observed within specified CJIS data repositories.

Input: Users submit a CAS message to the NCIC with biographic information such as name, date of birth, and selected identifiers (SSN, DL#, etc).

Repositories: The user specifies which repositories for which they are interested in receiving notifications. For purposes of the demo, the user should be able to select from the following list of CJIS repositories. Note that the user can enter multiple values for the NDR field.

1. All

2. Wanted Person File

3. National Sex Offender Registry

4. NICS Denied Transaction File

5. Violent Person File

6. N-DEx Integrated Person Entity Repository

7. Interstate Identification Index (III) File

Processing: The CAS message must traverse the user’s state system. Therefore, the C360 environment must forward the CAS message to the user’s state system for processing.

Response: The initial response message will indicate that the message was received and that CJIS will notify the user of any subsequent data encounters within the specified list of NDR values. When CJIS does encounter the selected information within one of the NDR values, it will create a CASN (CJIS Alert Service Notification) message and send that message to the user via the user’s state system.

pg. 9

7. Business Capability: Crime Reporting The C360 environment needs to allow users to view crime data published to the law enforcement community. Much of this functionality will be a consolidation effort to consolidate reporting data from current sources into a single experience. Further requirements work needs to occur to obtain MVP specifications.

8. Business Capability: Data Management Services The FBI CJIS Division manages data repositories (See Diagram 1) that support public safety, identification, investigation, and crime data services. The C360 will demonstrate how a user can manage data within these repositories from their state system or the C360 user experience.

The C360 will highlight a subset of the FBI CJIS Division data repositories.

8.1 Want Management

Wants are managed by users that send enter, modify, locate, or clear messages to NCIC via their state system. This is not a function that states have today via the Law Enforcement Enterprise Portal (LEEP) web page at https://www.cjis.gov. As part of the C360 prototype, we want to demonstrate how this function would look if we allowed users to perform want maintenance from the C360 portal.

Note that all want management messages must traverse the state system that is connected to NCIC.

Therefore, when users of the C360 environment issue want management transactions, the C360 system must transmit the message to the user’s state system for processing. If approved for processing, the state system will forward the message onto NCIC.

8.2 Incident Repository Management

He C360 prototype should provide a full set of interfaces to allow a state to manage information from its records management system (RMS) that it wishes to share with other states.

Note that this functionality is evolving, and that the concept exploration process will include updated mechanisms for national information sharing of RMS data.

8.3 NICS Indices Management (Firearm Prohibitors)

Users of the C360 should be able to add or remove individuals from the NICS Indices.

All NICS indices modifications happen via the state NCIC connection. Therefore, when users of the C360 environment perform a function to add or remove an individual from the NICS indices, the C360 system must transmit the request to the user’s state system for processing.

7.4 NIBRS Data Management

The C360 prototype should provide a full set of interfaces to allow the state to manage its NIBRS data submissions.

9. Business Capability: Collaboration Services The CJIS Division would like to explore updated collaboration services to provide the community with an improved collaboration and information sharing capability. The C360 prototype should provide

pg. 10 capabilities for teams to collaborate to manage events and activities in various public safety and criminal justice scenarios.

10. Conclusion This document provides the basic MVP definition that can be used to create the initial C360 prototype environment. Once the MVP is established, the CJIS team will work with the C360 beta testing team and the technology provider to revise and refine the concepts and functionality to be demonstrated.

5.2 CJIS Alert Service (CAS/CASN)