Attachment_1_Channeler_Guidelines.pdf

Channeler Guide

February 3, 2012

Table of Contents

Background Check Requirements Background Check Instructions Background Check Forms

Authorized Recipient Request Language Sample Request Letter

FBI Response Letter Sample FBI Response Letter (via fax)

Contract Language between an AR and Channeler Sample Contract Language

Quarterly Reports Sample of Quarterly Report

Subcontracting

U.S. DO 556-73 Submissions – Background DO 556-73 Policy Requirements DO 556-73 Channeler Restricted Requests DO 556-73 Causes for Contract Termination

Fingerprint Information Electronic Biometric Transmission Specification (EBTS)

Processing DO 556-73 Requests – Requirements DO 556-73 Request Form

Fingerprint Responses

IAFIS Reject Codes

Resubmission Guidelines

Name Check Procedures FBI Name Check Requirements FBI Name Check Form

Financial Processes Fees Payment

Audit Responsibilities

Security Requirements

Hot Check Notifications

Wanted Person Identifications

Information Resources/Training

Personally Identifiable Information (PII) Breaches

Channeler Guide

This document provides general information to the Channelers regarding the outsourcing requirements and procedures. This should not be considered an all inclusive document. This is also a living document and as changes occur, a new version will be provided. Additional questions may be directed to Diane Shaffer at (304) 625-2615 or via e-mail at <diane.genatowski@leo.gov>.

Background Check Requirements

Channeler personnel must first undergo an FBI fingerprint-based background check and be approved by the FBI prior to having access to FBI-provided Criminal History Record Information (CHRI). The background check procedures are included on page 18 of this guide.

The background check forms are on pages 27-29. Background checks for Channeler personnel and/or non-Channeler (approved subcontractor) personnel must be completed prior to performing work under the contract. For additional information, contact Mr. Jarrod Marozzi at 304-625- 2129 or <jarrod.marozzi@leo.gov>.

Authorized Recipient Request Language

Section 2.01 of the Security and Management Control Outsourcing Standard for Channelers (Outsourcing Standard) provides that, “Prior to engaging in outsourcing any noncriminal justice administrative functions, the Authorized Recipient shall: (a) request and receive written permission from (1) the State Compact Officer/Chief Administrator or (2) the FBI Compact Officer.” A sample request letter that an Authorized Recipient may use to request permission from the FBI Compact Officer to outsource noncriminal justice administrative functions to an FBI-approved Channeler is included on page 20. The request can be forwarded to the FBI Compact Officer, Gary Barron by mail to: FBI CJIS Division, Attn: Gary Barron, Mod D3, 1000 Custer Hollow Road, Clarksburg, WV 26306, by fax at (304) 625-2868, or via e-mail at <gary.barron@leo.gov>.

FBI Response Form

The FBI Compact Officer will provide a response letter to the written request from the Authorized Recipient. See page 21 for an example of a typical response to a channeling request.

The response letter for authorized financial institutions and public housing authorities will be faxed to the Authorized Recipient and Channeler. Faxed copies of the response letters will not be mailed.

All denial letters and other approval letters will be mailed or emailed to the Authorized Recipient and the Channeler.

Contract Language between and Authorized Recipient and Channeler

Section 2.02 of the Outsourcing Standard states that “the authorized recipient shall execute a contract or agreement prior to providing a Contractor access to CHRI.” The contract shall, at a minimum, incorporate by reference and have appended thereto this Outsourcing Standard.”

The FBI requests that the first executed contract between a Channeler and Authorized Recipient be sent to the FBI (email is preferred) for approval. A sample of contract language is provided on page 22. Please forward the contract for review and approval to Ms. Shaffer, with a copy to Ms. Sandra Bajus at <sandra.bajus@leo.gov>.

If subsequent contracts contain the same language except for the name of the Authorized Recipient, it is not necessary to provide the FBI copies of subsequent contracts, unless specifically requested by the FBI Compact Officer.

Quarterly Report

Quarterly reports are due to Mr. Travis Reynolds at <travis.reynolds@ic.fbi.gov>, Ms. Dawn Morgan at <dawn.morgan@ic.fbi.gov>, and Ms. Shaffer on March 1st, June 1st, September 1st, and December 1st. Please include new Authorized Recipients and contract dates for each quarter along with any updates. A sample of the Quarterly Report is provided on page 23.

Subcontracting

Pursuant to Section 7.5 of the Request for Proposal (RFP), “the Contractor shall not enter into a subcontract for any of the services performed under this Contract without obtaining the prior written approval of the FBI Contracting Officer.” Please forward a request to subcontract to Mr. Reynolds and Ms. Morgan, with a copy to Ms. Shaffer. The FBI will respond in writing to your request notifying you if you are allowed to use the subcontractor.

Per Section 9.2 of the RFP, “The Contractor must maintain direct connectivity to the FBI in accordance with the RFP, the Outsourcing Standard and the FBI CJIS Security Policy at all times.”

U.S. Departmental Order (DO) 556-73 (DO 556-73) Submissions - Background

The federal regulations pertaining to the DO 556-73 process are found at 28 Code of Federal Regulations 16.30-16.34. These regulations establish procedures to be followed when an individual subject of an FBI criminal identification record requests production of that record to review it or obtain a change, correction, or updating of that record. The FBI CJIS Division’s specific procedures and forms may be found on the FBI’s website (www.fbi.gov).

Under DO 556-73, an individual may obtain a copy of his/her FBI criminal identification record, upon request, for review and correction purposes, to challenge the information on record, or satisfy certain legal requirements: adopting a child; to satisfy a requirement to live in a foreign country; to satisfy a requirement to work in a foreign country; to satisfy a requirement to travel in a foreign country; and/or other court-related matters.

DO 556-73 Policy Requirements

A Channeler processing DO 556-73 requests is expected to follow the same regulatory and policy requirements regarding the receipt of the written information form, complete set of fingerprints, and appropriate fee from the individual.

A Channeler submitting DO 556-73 transactions on behalf of individuals must first request a unique Originating Agency Identifier (ORI) from the FBI. After a Channeler has requested and acquired a unique ORI for processing DO 556-73 requests, there are specific security and privacy requirements that must be maintained and adhered to for processing DO 556-73 requests at all times.

Compliance with the requirements listed in the most current versions of the Outsourcing Standard and the CJIS Security Policy will ensure that a Channeler complies with site security, personnel security, data security, system security and dissemination safeguards. The following sections of the Outsourcing Standard for Channelers are mandatory requirements for processing DO 556-73 requests: Section 2.03(a), Section 2.03(b), Section 2.03(c), Section 2.05, Section 3.01, Section 3.02, Section 3.03, Section 3.06, Section 3.08, Section 3.09, Section 4.01, Section 4.02, Section 5.0 (Dissemination), Section 6.0 (Personnel Security), Section 7.0 (Site Security), and Section 8.0 (Security Violations).

DO 556-73 Channeler Restricted Requests

1) An individual requiring an apostille1 or authenticated copy of his/her FBI criminal identification record must submit a request directly to the FBI CJIS Division for processing.

2) Any non U.S. person making a request for his/her FBI criminal identification record must submit his/her request directly to the FBI CJIS Division to be processed.

3) Should a Channeler be contacted to obtain an FBI criminal identification record for an individual requesting an apostille or a non U.S. person, the Channeler is required to instruct the individual to follow the instructions provided on the FBI website.

4) An individual making a request for employment or licensing purposes.

DO 556-73 Causes for Contract Termination

1. Failure to comply with any applicable federal law or regulation, as well as all requirements and policies explained in this document.

1 An apostille is a certification that a document that has been “legalized” or “authenticated” by the issuing agency through a process in which various seals are placed on the document.

2. Notifying an individual of a law enforcement agency inquiry regarding an NCIC hot check notification.

3. Knowingly processing DO 556-73 requests for individuals who are not U.S. persons.

4. Knowingly processing DO 556-73 requests for employment and/or licensing purposes.

5. Knowingly processing DO 556-73 requests that require an apostille or authenticated copy of an individual’s record.

6. Advertising, soliciting, proposing, or utilizing the DO 556-73 process for employment and/or licensing or any other unauthorized purpose.

7. Submitting a name check for an individual requesting a DO 556-73 request.

Fingerprint Information

Electronic Biometric Transmission Specification (EBTS)

The FBI CJIS Division utilizes the EBTS for Data Format for the Interchange of Fingerprints.

The EBTS Version 9.3, released on December 9, 2011, is the latest version and should be referenced for information. Due to the increased emphasis placed on communicating interface formats and guidelines, the Integrated Automated Fingerprint Identification System (IAFIS) users are encouraged to register within this website to receive future notifications on FBI Biometric Standards, Next Generation Identification capability implementation details, and EBTS updates. A copy of the EBTS may be obtained at the following website:

<www.fbibiospecs.org>.

The minimum record set includes Type 1, 2, and 4 or 14 records for each submission. All EBTS mandatory fields must be sent. In addition, the following EBTS fields should contain the provided data elements to meet the Channeler requirements:

1.004 TOT Type of Transaction - Must be NFUF or DOCE.

1.007 DAI Destination Agency Identifier - Should contain the value “WVIAFIS0Z”. NOTE:

The character before the Z is a numeric zero (0).

1.008 ORI Originating Agency Identifier - Should contain the non-federal or departmental order ORI assigned to the Channeler.

1.009 TCN Transaction Control Number - This is a unique number assigned to the record by the Channeler. (If the agency you are channeling for has a valid ORI number (i.e., public housing authorities), please utilize that number.)

1.010 TCR Transaction Control Reference field - This field shall be used in responses only to refer to the TCN of a previous transaction involving an inquiry or other action that required a response. For resubmissions, use the received TCN in the TCR field.

2.005 RET Retention Code - “N” for No

2.037 RFP Reason Fingerprinted

*Fax approvals for a financial institution, the RFP is “Other Employment and

Licensing” *Fax approvals for a public housing authority, the RFP is “Public Housing” *Formal letter responses will include the RFP in the body of the letter.

*All Departmental Order submissions, the RFP is “DO 556-73 Request” The RFP must be verbatim or the submission will be rejected.

2.070 RAP Rap Sheet - Request for Electronic Rap Sheet

2.073 CRI Controlling Agency Identifier - Must enter the same ORI identifier that is used in the ORI field.

*CJIS has the right to assign a number at any time during the contract. The channeler will be notified if such change were to occur.*

The Channeler must assign a number for each Authorized Recipient to identify and track submissions, send responses, and collect fees. The FBI CJIS Division recommends using the Originating Agency Case (OCA) (2.009) field or the second occurrence of the Controlling Agency Identifier (CRI) (2.073) field. The OCA alphanumeric-special field contains one to twenty characters and any printable 7-bit ASCII character with the exception of the period (.) or a blank in the first position. The second CRI field must be a nine-byte alphanumeric field.

(If the agency you are channeling for has a valid ORI number with the FBI (i.e., public housing authorities), please utilize that number.)

The Channeler shall not retain fingerprint cards and fingerprint images used for submissions, unless directed so by the Authorized Recipient under contract, for longer than 30 calendar days.

All fingerprints cards and fingerprint images used for DO 556-73 submissions may not be retained for a period longer than 30 calendar days or upon successful dissemination, whichever is shorter. All fingerprint cards and fingerprint images must be destroyed/deleted in a manner consistent with the Outsourcing Standard and the FBI CJIS Security Policy.

Processing DO 556-73 Requests - Requirements

1) A Channeler may only submit requests for a U.S. person (who is a citizen of the U.S.

or a lawful permanent resident of the U.S.).

2) The fingerprint submission must include the individual’s complete legal name (to include first, middle, and last name); date of birth; signature (if applicable);

descriptive data, such as sex, race, gender; date fingerprinted; and the reason fingerprinted (RFP). The RFP literal must state “DO 556-73 REQUEST.”

3) A Channeler shall ensure the fingerprint submission includes ten rolled fingerprint impressions and ten plain fingerprint impressions or ten flat fingerprint impressions segmented as outlined in the latest version of the Electronic Biometric Transmission Specification (EBTS).

4) Each fingerprint submission must be accompanied by a signed DO Request Form, filled out in its entirety, from the individual seeking his/her FBI criminal identification record pursuant to DO 566-73. The DO Request Form is provided on page 24. A Channeler may change the format of the DO Request Form; however, all necessary information must be included on the Channeler’s version of the form.

Should a Channeler desire to make changes to the provided DO Request Form, the FBI must review and approve these changes prior to use. Any and all subsequent revisions must also be reviewed and approved by the FBI prior to use.

5) A Channeler must maintain each DO Request Form with the original signature from each individual, for a period of three (3) years or upon termination of the contract, whichever is shorter. Maintenance of the DO Request Forms may be in digitized or hard copy format.

6) At the end of the mandatory retention period, all DO Request Forms must be destroyed in accordance with the provisions outlined in the most current versions of the Outsourcing Standard for Channelers (currently Sections 7.02 (b) and (c)) and the CJIS Security Policy for fixed storage media and disposal of all non-fixed storage media of criminal history record information (CHRI).

7) Fingerprints must be captured by a law enforcement agency or Channeler. An individual may not capture his/her own fingerprints on a fingerprint card.

8) If an individual submits fingerprints in person through a Channeler or other entity authorized by a Channeler, the following requirements must be met:

a) The individual’s identity must be verified by two forms of identification (at least one of which must be a government issued photo ID).

b) The mailing address of the individual making the request must match at least one form of identification provided to a Channeler as listed on the DO Request Form.

9) If a DO 556-73 request is made through an attorney, the request shall be submitted on attorney letterhead with both the individual and the attorney signatures, and shall contain a release statement.

10) The same fingerprint images may not be used for more than one submission per individual. In case of fingerprint quality rejects, a Channeler should initially obtain two sets of fingerprint images for an individual for resubmission purposes.

Fingerprint Responses

The FBI will return the results of each fingerprint-based national criminal history record check electronically to the Channeler. The FBI’s IAFIS will process each transaction and send the Channeler an IAFIS Tenprint Response, the Submission Results-Electronic (SRE). The SRE will contain the ident/non-ident response, the rap sheet (when applicable), or a Reject Message (ERRT). A list of ERRT’s can be found in the EBTS. Sample SREs are available upon request.

***A Channeler may not maintain the SRE in their dissemination log.

A Channeler shall expeditiously disseminate the criminal history record (CHR) check results to the individual/authorized agency making the request as specified in the Outsourcing Standard (currently Section 5.0). All electronic dissemination (email or through a website) must meet or exceed the requirements outlined in the CJIS Security Policy for encryption. CHRI disseminated by a Channeler via an authorized website shall remain on such website only for the time necessary to meet the individual’s requirements but in no event shall that time exceed 30 calendar days.

All FBI responses shall be provided in the exact format it was received by a Channeler with no deviation or changes made to the document(s).

A Channeler shall establish a system that ensures that each SRE and rap sheet (when applicable), either paper or electronic, cannot be altered or copied without detection. A Channeler shall maintain CHRI only for the period of time necessary to fulfill its contractual obligations.

A Channeler’s security system shall comply with the CJIS Security Policy and the Outsourcing Standard. A Channeler is responsible for protecting CHRI with firewall-type devices for the prevention of unauthorized access. Data encryption shall be required throughout the network passing CHRI through a shared public carrier network.

CHRI shall be destroyed by a Channeler immediately after confirmation of successful receipt by the individual, regardless of mode. CHRI must be destroyed in compliance with the criteria in the Outsourcing Standard (currently Sections 7.02 (b) and (c)). The manner and time period for CHRI dissemination by a Channeler to an individual shall be defined in the relevant contract.

IAFIS Reject Codes

The most common IAFIS reject codes include the following:

• L0008 - "The quality of characteristics is too low to be used." This reject occurs when the image quality score is below the acceptable threshold as determined by IAFIS. You can prevent this reject by ensuring each fingerprint is rolled fully and clearly. Ensure delta(s) and core(s) are present for each fingerprint.

• L0116 - "Fingerprint pattern(s) not discernable." This reject occurs when the images are poor quality as determined by an FBI Fingerprint Examiner. You can prevent this reject by ensuring each fingerprint is rolled fully and clearly. Ensure delta(s) and core(s) are present for each fingerprint.

• L0118 - "Erroneous or incomplete fingerprint(s) on images: fingers or hands out of sequence, printed twice, missing, and no reason given." This reject occurs when the fingers are not in the correct sequence or images are missing without a reason given. The two acceptable reasons for missing images are Amputation or Unable to Print. You can prevent this reject by ensuring each rolled fingerprint is in the correct position by comparing with the fingerprint impressions taken simultaneously (plain/flat impressions).

Ensure a reason is provided for any missing images. Use either Amputation or Unable to Print.

The top ten IAFIS Reject Codes may be found at the FBI’s website at <www.fbi.gov>. Select Fingerprints, then IAFIS, then select the topic (How to Prevent IAFIS Ten-Print Rejects).

Resubmission Guidelines

• If a civil submission rejects for fingerprint image quality, a second submission can be processed at no charge by following the FBI CJIS Division's resubmission guidelines.

The agency must place the received Transaction Control Number (TCN) (1.009) field from the electronic fingerprint response of the original rejected submission in the Transaction Control Reference (TCR) (1.010) field of the new submission. Time restrictions apply for this service; the second submission must be within one calendar year after the original fingerprint submission was rejected.

• For additional questions, contact the FBI CJIS Division Customer Service Group at

(304) 625-5590 (8:00 a.m. - 8:00 p.m., Monday-Friday, Eastern Time).

Name Check Procedures

• The Name Check service is a process performed for civil fingerprint submissions for noncriminal justice purposes only after two fingerprint submissions for the same individual have been rejected due to poor image quality. Time restrictions apply for this service; a name check request must be within 90 days after the second submission was rejected. The agency submits a request via the CJIS Name Check Request form. The form may be found at the FBI’s website at <www.fbi.gov>. Select Fingerprints, then select the topic (FBI Name Checks for Fingerprint Submissions). The FBI notes they can neither confirm nor deny positive identification based on a name check. See page 25 for instructions and page 26 for the name check request form).

• It is the Channeler’s responsibility (only when requested by the Authorized Recipient) to complete the CJIS Name Check Request form and send it to the FBI.

• In accordance with Section 9.9 of the RFP, “the Contractor shall not submit a name check for an authorized individual(s) requesting a national noncriminal justice criminal history record check under the authority of the DO 556-73.”

Financial Processes

Reference is made to Section 9.0 Requirements and Section 15.0 Federal Bureau of Investigation (FBI) Responsibilities of the Request for Proposal.

Although these sections provide pertinent information on the billing processes, the following will further assist with the FBI CJIS Division billing procedures.

The FBI CJIS Division has assigned your agency, by request, Originating Agency Identifiers (ORIs) for non-federal noncriminal justice applicant fingerprint submissions and/or departmental order fingerprint submissions.

Fees

Type of Submission Fee Amount Submitted to the FBI

Additional Fee which may be charged by Channeler

Non-Federal Applicant

$17.25

Subject to contract with Authorized Recipient

Departmental Order

$18

All FBI fees are subject to change. Channelers will be notified of changes ninety (90) days prior to the effective date, either in writing from the FBI or through publication in the Federal Register. Any additional fee authority shall be pursuant to the Channeler’s contract with the Authorized Recipient(s).

**Per the Channeler Kickoff teleconference and the Federal Register Notice provided following the teleconference – a fee change will become effective March 19, 2012.

Type of Submission Fee Amount Submitted to the FBI

Additional Fee which may be charged by Channeler

Non-Federal Applicant

$14.50

Subject to contract with Authorized Recipient

Departmental Order

$18

Payment

The charges that appear on the bill will reflect those transactions that are completed. Each non-federal and/or departmental order bill will contain a Central Agency Summary page, Remittance page, ORI Summary page, and a compact disk, with the detailed transaction listing for that billing period.

A separate bill will be sent to the channeler for each ORI assigned. Please remit separate checks for each bill received.

The FBI charges a fee for the processing of each civil applicant fingerprint submission and each departmental order fingerprint submission. The FBI will not charge the Channeler for the first resubmission of image quality rejected submissions, providing the resubmission policy is followed. A fee will be charged for subsequent (multiple) submissions of an applicant’s fingerprints. To avoid incurring additional charges when resubmitting fingerprints electronically, the Channeler must follow the resubmission procedures provided in the EBTS.

A Channeler shall submit payment to the FBI within thirty (30) calendar days from the invoice date. A Channeler shall be responsible for all collections from an individual/authorized agency making a CHR check. The FBI CJIS Division will not assist a Channeler in collecting “bad” debts or grant billing adjustments for any such failed collection.

All remittances should be made payable and sent to the following address:

Federal Bureau of Investigation Criminal Justice Information Services Division 1000 Custer Hollow Road Clarksburg, WV 26506 Attention: Fee Programs Unit

If you dispute a transaction, please contact the FBI CJIS Division at (304) 625-5590. Please DO NOT subtract any disputed monies from your bill or payment without notifying the FBI CJIS Division. *Billing adjustments will be made on a limited and extenuating circumstance basis.*

Current FBI policy allows the Channeler one calendar year from the date the FBI CJIS Division completed the fingerprint processing to request billing adjustments. If the contractor is aware of a potential billing error prior to receipt of the bill from the FBI CJIS Division, the contractor should contact the FBI CJIS Division immediately at (304) 625-5590 to correct the error.

If the contractor has any questions concerning payments or a change of an address, please contact Fee Programs Unit at (304) 625-2360 or <feeprogramsunit@leo.gov>.

Audit Responsibilities

The FBI shall conduct an audit of a Channeler within 90 days of the date a Channeler first receives CHRI under the terms of the Outsourcing Standard. In addition, the FBI shall conduct one year and triennial audits of a Channeler thereafter.

A Channeler shall provide all logs required to be maintained by a Channeler as listed in the Outsourcing Standard to the FBI during announced and unannounced audits, to include but not limited to, dissemination of CHRI.

The FBI Compact Officer, National Crime Prevention and Privacy Compact Council (Compact Council), and the U.S. Attorney General reserve the right to audit a Channeler’s operations and procedures at scheduled or unscheduled times.

The Compact Council and the U.S. Attorney General are authorized to perform a final audit of a Channeler’s system after termination and/or conclusion of the contract between the FBI and a Channeler.

Please refer to the Outsourcing Standard for more specific requirements and responsibilities.

Security Requirements

A Channeler shall develop, document, administer, and maintain a Security Program (to include physical, personnel, and information technology) that complies with the most current versions of the Outsourcing Standard for Channelers and the CJIS Security Policy. The Security Program shall describe the implementation of the security requirements described in the Outsourcing Standard for Channelers and the CJIS Security Policy. In addition, the Channeler is also responsible to set, maintain, and enforce the standards for the selection, supervision, and separation of personnel who have access to CHRI. The FBI shall provide the written approval of a Channeler's Security Program.

The requirements for a Security Program should include, at a minimum:

a) description of the implementation of the security requirements explained in the

Outsourcing Standard for Channelers and the CJIS Security Policy,

b) security training,

c) guidelines for documentation of security violations, and

d) standards for the selection, supervision, and separation of personnel with access to

CHRI.

**If a Channeler follows a corporate security policy, it must meet or incorporate the requirements outlined in the Outsourcing Standard for Channelers and the CJIS Security Policy.

The FBI shall ensure that a Channeler’s site is a physically secure location to protect against unauthorized access to CHRI. All visitors to computer centers and/or terminal areas shall be escorted by authorized personnel at all times.

The FBI shall conduct criminal history record checks of Channeler (and approved sub-contractor) personnel having access to CHRI. A Channeler shall confirm in writing that each employee has certified that he/she understands all requirements and laws that apply to his/her responsibilities.

Criminal history record checks and the certification must be completed prior to accessing CHRI.

All Channeler (and approved sub-contractor) personnel must complete, and verify to the FBI, any mandatory training provided by the FBI. A list of Channeler personnel who have access to CHRI shall be maintained by the FBI, with updates provided by the Channeler within 24 hours to the FBI when changes occur. All access to, and dissemination of, CHRI and associated PII is for official purposes only.

If CHRI can be accessed via Wide Area Network/Local Area Network or the Internet, then the Channeler shall protect the CHRI with firewall-type devices to prevent unauthorized access. In addition, data encryption shall be required throughout the network passing CHRI through a shared public carrier network.

An up-to-date log concerning dissemination of CHRI shall be maintained by a Channeler for a minimum one year retention period. This log must clearly identify: (a) the individual and the secondary recipient, with assigned unique identifying numbers; (b) the record disseminated;

(c) the date of dissemination; (d) the statutory authority for dissemination; and (e) the means of dissemination.

If CHRI is stored or disseminated in an electronic format, a Channeler shall protect against any unauthorized persons gaining access to the equipment and any of the data. In no event shall responses containing CHRI be disseminated other than governed by the Outsourcing Standard for Channelers or more stringent contract requirements.

All access attempts are subject to recording and routine review for detection of inappropriate or illegal activity. A Channeler=s system shall be supported by a documented contingency plan as defined in the CJIS Security Policy and approved by the FBI.

A Channeler shall provide for the secure storage and disposal of all hard copy and media associated with the system to prevent access by unauthorized personnel. The FBI shall ensure that a procedure is in place for sanitizing all fixed storage media (e.g., disks, drives, backup storage) at the completion of the contract. The FBI shall ensure that a procedure is in place for the disposal or return of all non-fixed storage media (e.g., hard copies).

A Channeler shall maintain a written policy for discipline of employees who violates any security or privacy provisions of these requirements, the relevant contract, the Outsourcing Standard for Channelers, and the CJIS Security Policy. A Channeler shall not permit any employee suspected of committing a violation to have access to CHRI.

A Channeler shall immediately (within four hours) notify the FBI and/or individual of any security violation to include unauthorized access to CHRI. Within five calendar days of such notification, the Channeler shall provide the FBI and/or individual with a written report documenting such security violation, any corrective actions taken by the Channeler to resolve such violation, and the date, time, and summary of the prior notification. Each individual shall be provided information regarding a means of notifying the FBI of any security violation (to include unauthorized access to CHRI).

The FBI Compact Officer, Compact Council and the U.S. Attorney General reserve the right to investigate or decline to investigate any report of unauthorized access to CHRI.

Hot Check Notifications

• The FBI CJIS Division conducts automated name-based searches (“Hot Check”) of the

National Crime Information Center’s (NCIC’s) Wanted Person File (WPF) and the Terrorist portion of the Violent Gang and Terrorist Organization File’s (VGTOF) records on all ten-print fingerprint submissions.

• Law Enforcement agencies may contact the submitting agency (Channeler) for applicant information if the agency receives information through the FBI's Hot Check service.

Do not advise the applicant!

Wanted Person Identifications

• Law Enforcement agencies may contact the submitting agency (Channeler) for applicant information (e.g. address) if the WPF data is a match for a fingerprint submission.

Do not advise the applicant!

Information Resources/Training

For fingerprint processing questions (i.e., submission status inquiries, rejections), please contact the FBI CJIS CSG at (304) 625-5590 (8 a.m. – 8 p.m., Monday-Friday, EST).

For policy and procedural questions, please contact Ms. Diane M. Shaffer at (304) 625-2615 or via e-mail at <diane.genatowski@leo.gov>.

For technical or hardware issues (i.e., management of lines, connection problems), please contact the FBI CJIS Division Help Desk at (304) 625-4357 (24 hours a day, 7 days a week).

Limited courses are offered by the FBI on “Fingerprint and CHR Training” and “Recording Legible Fingerprints.” Requests for such courses may be sent to <liaison@leo.gov> for more information.

*Personally Identifiable Information (PII) Breaches*

The FBI and all federal executive agencies define PII as “information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth or mother’s maiden name.”

Therefore, the DO Request Form, the fingerprint card, and the SRE for an individual (to include the rap sheet) all contain PII. Other information submitted by the individual may also contain PII, such as personal information provided when making payment for a DO 556-73 request.

A PII breach occurs when there is a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any situation where persons other than the authorized users, and for other than authorized purposes, have access or potential access to PII, whether physical or electronic. A PII breach may be accidental or purposeful.

Pursuant to the Department of Justice (DOJ) Memorandum, the loss of any sensitive FBI information must be reported to the FBI immediately so steps may be taken to investigate and mitigate the loss. The FBI is required to report breaches to the DOJ within one hour of discovery of the loss. Because of these requirements, it is necessary for a Channeler to contact the FBI CJIS Division as soon as any PII breach occurs so that the FBI may determine the severity of the breach and the associated reporting requirements. All PII breaches or questions concerning possible PII breaches may be directed to the Customer Service Group by calling (304) 625-5590 and requesting to speak with a PII point of contact.

A Channeler is responsible for protecting all PII in its possession and control during the processing of all requests. In addition, a Channeler should notify the individual making the DO 556-73 request of his/her right (via language approved by the FBI) to report PII breaches to the FBI should he/she believe personal information has been compromised.

Background Check Requirements for Channeler Employees

Below are general instructions and guidelines on completing the background check forms in order to proceed with Channeler employee’s criminal history record checks. Please include as much information as possible. Incomplete applications will not be processed. See pages 27-29 for copies of the forms.

1) Complete all paperwork and return for processing to:

(NOTE: Do Not Fold Fingerprint Cards) FBI CJIS Division Attn: Jarrod Marozzi 1000 Custer Hollow Road Clarksburg, WV 26306-0174

Required forms:

Two (2) sets of Fingerprints on FD-258 (Applicant Fingerprint cards) FD-484 (Privacy Act Notice for Maintenance Employees) FD-816 (Access of Non-FBI Personnel to FBI Facilities)

Instructions for FD-258:

• Must be filled out in black ink.

• Original Signature of person fingerprinted.

• Complete residence address of person fingerprinted (include city, state and zip code).

• Date fingerprints taken: Fingerprints must be current (taken within the last 60 calendar days).

• Original Signature of the official taking fingerprints is required.

• Employer’s complete address (include city, state and zip code)

• Indicate “Channeler Outsourcing” in the Reason Fingerprinted field

• Full Name (First, Middle, Last) must be complete. Do not use initials. If there is no middle name, indicate by noting “NMN”.

• Note any aliases used by person being fingerprinted.

• For date of birth, indicate month, day, and year (i.e., 01/01/2000).

• Indicate citizenship.

• In the appropriate field, list physical descriptors and social security number

• Place of Birth (include city and state; i.e., Bobtown, PA)

Complete FD-484:

• Provide the original form with signature (preferably in blue ink) and date.

• Submit within 30 calendar days from the date the applicant signed/dated the form. Forms that are not submitted and processed within 30 days will be returned.

Instructions for FD-816:

• Provide the original form with signature (preferably in blue ink) and date.

• Full Name (First, Middle, Last) must be complete. Do not use initials. If there is no middle name, indicate by noting “NMN”.

• List any other names used (i.e., maiden name).

• Complete residential address (street, city, state, zip code)

• Note social security number, date of birth (month/day/year), place of birth (city/state), and sex

• Complete company address (street, city, state, zip code)

• Supervisor’s name and complete phone number (area code included)

SAMPLE REQUEST LETTER

[Authorized Recipient’s name] TO USE

[Contractor’s name] AS A CHANNELER FOR THE SUBMISSION OF

AUTHORIZED NONCRIMINAL JUSTICE BACKGROUND CHECKS

Mr. Gary S. Barron, FBI Compact Officer FBI CJIS Division 1000 Custer Hollow Road, Module D3 Clarksburg, West Virginia 26306

Dear Mr. Barron:

[Insert Authorized Recipient’s name and address], the Authorized Recipient, requests permission to outsource noncriminal justice administrative functions to FBI-approved Channeler, [insert Contractor’s name and address], the Contractor, to perform “Channeler” functions as set forth below. This request is made pursuant to Title 28, Code of Federal Regulations, Part 906 and the relevant Security and Management Control Outsourcing Standard for Channelers (Outsourcing Standard). [Insert Authorized Recipient’s name]’s authority to submit fingerprints for noncriminal justice purposes and obtain the results of the fingerprint search, which may contain criminal history record information (CHRI), is pursuant to [insert the legal citation of the statute, public law, or Federal executive order that requires or authorizes the Authorized Recipient to have access to CHRI]. This authority requires or authorizes fingerprint-based background checks of [insert all categories of current and prospective employees, licensees, or applicants for other benefits covered by the statute, public law, or federal executive order].

[Insert Contractor’s name] will serve as a “Channeler” on behalf of [insert Authorized Recipient’s name].

The noncriminal justice administrative functions to be performed by the Channeler that may result in Channeler access to CHRI on behalf of [insert Authorized Recipient’s name] are:

• Receive noncriminal justice applicant fingerprint submissions and collect associated fees;

• Ensure each fingerprint submissions is properly and adequately completed;

• Electronically store and forward [insert estimated number of annual submissions] fingerprint transactions to the FBI’s CJIS Division for national criminal history record checks;

• Receive electronic criminal history record check results from the FBI;

• Promptly disseminate all criminal history record check results to [insert Authorized

Recipient’s name] by [insert means of dissemination – e.g. United States mail, e-mail, or posting to a web site]; and

• Comply with all Outsourcing Standard requirements.

[Insert Authorized Recipient’s name] inquires of the FBI Compact Officer whether [insert Contractor’s name] has any previous record of security violations. Upon execution of the Contract, [insert Authorized Recipient’s name] will take responsibility for [insert Contractor’s name] compliance with the terms of the Contract, to include the relevant Outsourcing Standard, and will notify the FBI Compact Officer of any violations.

Sincerely, [insert name] [insert current ORI, if applicable] [insert title] [insert phone number] [insert fax number] [insert email address]

SAMPLE

TO: [Authorized Recipient name] [Contractor name] [POC] and [POC]

FAX #: [AR Fax Number] [Contractor Fax Number]

DATE: [Date]

RESPONSE LETTER FOR

[Authorized Recipient’s name] TO USE [Contractor’s name]

AS A CHANNELER FOR THE SUBMISSION OF AUTHORIZED

NONCRIMINAL JUSTICE BACKGROUND CHECKS

Authorized Recipient: [Authorized Recipient name]

APPROVED: _______________________________ DATE:____________

FBI COMPACT OFFICER

Contingencies:

1) Permission granted solely for the purpose of performing channeling functions as defined in the Security and Management Control Outsourcing Standard for Channelers (Outsourcing Standard). Please note that this approval is automatically rescinded if you lose your status as an Authorized Recipient or the above Contractor loses its status as a Channeler.

2) Pursuant to Footnote 2 of the Outsourcing Standard, the FBI will triennially audit a representative sample of Authorized Recipients (e.g., federally chartered or insured banking institutions) engaging in outsourcing with the first of such audits to be conducted within one year of the date the Contractor first receives CHRI under the approved outsourcing agreement.

**Pursuant to Section 2.01(c) of the Outsourcing Standard, the CJIS Division has no record of reportable security violations by the selected contractor.

NOTE: This Response Letter is being faxed to the Authorized Recipient and Contractor.

Copies will not be provided.

SAMPLE LANGUAGE

CONTRACT BETWEEN

[AUTHORIZED RECIPIENT’S NAME]

AND

[CONTRACTOR’S NAME]

REGARDING OUTSOURCING

NONCRIMINAL JUSTICE ADMINISTRATIVE FUNCTIONS

This contract is entered into between [insert Authorized Recipient’s name and address], the Authorized Recipient, and [insert Contractor’s name and address], the Contractor, under the terms of which the Authorized Recipient is outsourcing the performance of noncriminal justice administrative functions involving the handling of criminal history record information (CHRI) pursuant to Title 28, Code of Federal Regulations, Part 906 and the relevant Security and Management Control Outsourcing Standard for Channelers (Outsourcing Standard). The most current version of the Outsourcing Standard is incorporated by reference into this contract and appended hereto as Attachment “?”.

The Authorized Recipient's authority to submit fingerprints for noncriminal justice purposes and obtain the results of the fingerprint search, which may contain CHRI, is [insert the legal citation of the statute, public law, or Federal executive order that requires or authorizes the Authorized Recipient to have access to CHRI]. This authority requires or authorizes fingerprint-based background checks of [insert all categories of current and prospective employees, licensees, or applicants for other benefits covered by the statute, public law, or federal executive order].

The specific noncriminal justice administrative function to be performed by the Contractor that involve access to CHRI on behalf of the Authorized Recipient is to serve as an FBI-approved Channeler. The noncriminal justice administrative functions to be performed by the Channeler that may result in Channeler access to CHRI on behalf of [insert Authorized Recipient’s name] are 1) Receive noncriminal justice applicant fingerprint submissions and collect associated fees; 2) Ensure each fingerprint submission is properly and adequately completed; 3) Electronically store and forward [insert estimated number of annual submissions] fingerprint transactions to the FBI’s CJIS Division for national criminal history record checks; 4) Receive electronic criminal history record check results from the FBI; 5) Promptly disseminate all criminal history record check results to [insert Authorized Recipient’s name] by [insert means of dissemination – e.g. United States mail, e-mail, or posting to a web site]; and 6) Comply with all Outsourcing Standard requirements.

NOTE: [The Compact Officer/Chief Administrator may also request the Authorized Recipient to provide the contract or portion(s) of the contract that sets forth the above language, the signature page(s), and the page with the effective date of the contract].

Channeler for Noncriminal Justice Applicant Fingerprint Submissions Quarterly Reports

Contractor's Name:

Timeframe: (Check One)

03/01/12 – 05/31/12 _____ 06/01/12 – 08/31/12 _____ 09/01/12 – 11/30/12 _____ 12/01/12 – 02/29/13 _____ 03/01/13 – 05/31/13 _____ 06/01/13 – 08/31/13 _____ 09/01/13 – 11/30/13 _____ 12/01/13 – 02/29/14 _____

Third Party Connectivity Process List Status:

Bill Payment Status:

Non-Federal ORI _______________

DOCE ORI _______________

Contract Executed with (Name of Authorized Recipient): ____________________________ Date of Contract: ____________________ Date Authorized Recipient first received CHRI: _____________________ Number of Submissions: ______________________

Contract Executed with (Name of Authorized Recipient): ____________________________ Date of Contract: ____________________ Date Authorized Recipient first received CHRI: _____________________ Number of Submissions: ______________________

Miscellaneous:

APPLICANT INFORMATION FORM

PRIVACY ACT STATEMENT

The FBI’s acquisition, retention, and sharing of information submitted on this form is generally authorized under 28 USC 534 and 28 CFR 16.30-

16.34. The purpose for requesting this information from you is to provide the FBI with a minimum of identifying data to permit an accurate and timely search of criminal history identification records. Providing this information (including your Social Security Account Number) is voluntary;

however, failure to provide the information may affect the completion of your request. The information reported on this form may be disclosed pursuant to your consent, and may also be disclosed by the FBI without your consent pursuant to the Privacy Act of 1974 and all applicable routine uses.

Applicant Information* Denotes Required Fields

* Last Name

* First Name Middle Name 1 Middle Name 2

*Date of Birth Last Four Digits of Social Security Number

Applicant Home Address

* Address

* City * State

* Postal (zip) Code

* Country

Phone Number E-Mail

U.S. Citizen or Legal Permanent Resident Yes No Country of Citizenship: Country of Residence:

Payment Enclosed (please check appropriate box)

CASHIER’S CHECK MONEY ORDER CREDIT CARD FORM

Number of Copies_______ X $18 per Copy

Total Payment of $__________Enclosed

Reason for Request ___________________________________________________

* APPLICANT SIGNATURE __________________________________ DATE________

You may request a copy of your own identification record to review it or obtain a change, correction, or an update to the record.

FBI Name Checks For Fingerprint Submissions

Rejected Twice Due To Image Quality

When can I request a name check?

A name check can be requested when the fingerprints have been rejected twice for image quality by the FBI's CJIS Division.

Who can request a name check?

The name check is limited to state, federal and regulatory agencies who already have legal authority to submit fingerprints for noncriminal justice purposes.

How do I get the name check procedure started?

• Complete the attached name check request form.

• Mail or fax the form to:

FBI CJIS Division Fax (304) 625-5102 Attn: Name Check Request 1000 Custer Hollow Road Clarksburg, WV 26306

What do I need to include with my name check request?

• The Transaction Control Number (TCN), name, date of birth and social security number (if available) from the rejected fingerprint submissions.

• The Originating Agency Identifier (ORI) of the channeler.

• Contact information for the channeler including preference for receipt of the results, either fax or by mail.

NOTE: If candidates are generated during the name search and the candidates are identified to an existing criminal record, channeler will be provided with a copy of the criminal history record to immediately disseminate to the authorized recipient.

Is there a time limit for obtaining these name checks?

Yes, the name check request must be submitted within 90 days of the last rejection date.

Who can I contact if I have further questions about the name check process?

Should you have any questions, please contact the Biometric Services Section Name Check Unit at (304) 625-9450 between the hours of 6:00 am and 4:00 pm Eastern Standard Time Monday thru Friday.

CJIS Name Check Request – Channeler Name Check Request

Please complete the attached form to request a name check. Please be advised that an individual's fingerprints must be rejected twice for technical (image quality) issues prior to requesting a name check.

ORI of Channeling Agency: ________________________________

{Name of Authorized Recipient request is being made on behalf of: _____________________}

Your agency's Point of Contact (POC) for the response: _____________________

Phone number of POC: ________________________

Fax number of POC: __________________________

Address of requesting agency:

Please fax ____ or mail ____ my response to this request.

Subject of Name Check

Transaction Control Number (TCN) of subject's fingerprint submission:__________

Name: __________________________ Alias: ________________________

Date of Birth: _______________________ Place of Birth: ___________________

Sex: ____ Race: ____ Height: ____ Weight: ____ Eyes: ____ Hair: ____

Social Security Number: _______________ Miscellaneous Number: ________________

State Identification Number: ____________ OCA: ________________

* Please note that highlighted fields are required…