84702R8.pdf

UNCLASSIFIED

NI 8470.2R8 Approved: 9 December 2009 Subgroup: Communications and Electronics

NGA Instruction for Internet Usage

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary references are located in appendix 1.

2. Purpose. This instruction states the obligations of NGA personnel for access to the Internet at work for personal use and for official use at any location. This instruction supersedes NI 8470.2R6, same title, 5 January 2004.

3. Policy. To protect the information and information systems entrusted to it, NGA employees will use good judgment when utilizing the Internet for official or personal purposes and be aware of when Internet activity may create a vulnerability to NGA systems or programs. When accessing the Internet employees must comply with Intelligence Oversight, operational security, and intellectual property laws and regulations. Before conducting Internet collection for mission related intelligence information, employees must complete information assurance and Internet operational security training. NGA-sponsored accesses to Government systems and databases are subject to monitoring at all times through electronic auditing and use of NGA networks constitutes acceptance of monitoring.

4. Applicability and Scope. This instruction applies to all personnel with access to NGA computer networks and to personnel who receive approval to conduct official duties on non-official information devices or systems. Controls on the use of agency electronic communications systems (including telephones, messaging, electronic mail, facsimile transmissions, and other related activities) are described in NI 8470.3R8 (reference 5) and

NI 8400.1R7.

5. Definitions.

a. Non-attribution Internet access. Non-attribution Internet access removes the online association between an Internet Protocol (IP) address and NGA.

b. Governance of Internet geospatial open source collection. Acting in coordination with other NGA, Intelligence Community or Department of Defense offices to: develop policy for use of non-attribution Internet accounts, manage use of .com addresses, advise on classified collection of Internet open sources, advise on training and development of Internet collection tradecraft, and advise on what agency open source requirements can be acquired on-line.

NI 8470.2R8

Internet Usage

c. Mission related intelligence activity. Internet collection for Geospatial Intelligence (GEOINT) mission related intelligence information, and, where NGA’s interest in the subject is considered sensitive or might reveal classified topics of interest to NGA.

d. Large scale Internet data collection. Use of software to collect large amounts of GEOINT and related information from the Internet in order to evaluate the data on an independent server.

e. Internet Protocol address. A numerical identification assigned to a device participating in a network utilizing IP for communication between nodes.

f. HUMINT. The intelligence discipline which uses human beings as both the primary collection instrument and the source of information. HUMINT focuses on acquiring information relating to capabilities, intentions and activities of foreign powers, organizations or persons, including terrorists.

6. Responsibilities.

a. The Chief Information Officer oversees the development of policy and procedures related to management of information systems and resources. Office of the Chief Information Officer (OCIO), Information Security Management Division (OCIOCS), Information Assurance (OCIOCSI) responds to reports of virus infection, network penetration (real or suspected), and other network vulnerabilities as reported by system Information Assurance Officers (IAOs).

b. Source Research (SR) maintains the GEOINT Open Source Center of Excellence which provides governance of Internet GEOINT open source collection.

(1) SR develops guidelines for assessing the validity and quality of open source GEOINT collected from the Internet.

(2) SR makes recommendations on training needs for open source Internet collections including tradecraft, intellectual property, and intelligence oversight.

(3) SR develops and maintains the standard operating procedure for the download of information while using non-attribution Internet accounts, to include the use of a .com email address when a website requires it for information download.

(4) SR interfaces with the DNI Open Source Center, the program that provides non-attribution accounts for the purpose of sensitive GEOINT research or GEOINT collection.

(5) SR has oversight of the processes for conducting Large Scale Internet data extraction and responsibilities for retaining metadata associated with Large Scale Internet data extraction.

c. Security and Installation Operations Directorate, Security Office (SIS).

(1) SIS oversees information security practices within the Agency, including placement of classified or otherwise sensitive information on appropriate systems and implementation of appropriate access controls.

(2) The Computer Investigation and Awareness Division (SISC) monitors Internet usage at all NGA facilities and refers all cases of abuse to the Office of the Inspector General. In support to SISC organizations and offices search and review holdings of Internet data in response to requests from investigators for information related to external or investigative inquiries about Internet abuse.

(3) SISC supports investigations of waste, fraud, abuse, and misuse of NGA communication and network resources.

(4) SISC assists in the development of non-attribution account guidelines for mission related GEOINT online collections.

d. The Office of General Counsel (OGC) reviews collection and use of information from the Internet and advises on intellectual property, acquisition and intelligence oversight. OGC reviews investigations involving possible criminal misuse of Government resources and coordinates investigation and prosecution of computer misconduct.

e. The Office of Inspector General (OIG) investigates reports of waste, fraud, abuse, and misuse of NGA network resources. In ongoing cases where OGC has initiated contact, OIG coordinates ongoing investigations directly with DoD law enforcement agencies.

f. The Human Development (HD) Directorate, in conjunction with other offices, supports agency training courses for mission related use of Internet activity.

g. The Acquisition Directorate (A), Acquisition Contracts Office (AC), provides guidance for purchasing via the Internet. AC manages delegation of authority to credit card holders to make Internet based purchases.

h. Supervisors and managers.

(1) Ensure that employees understand the proper uses of network resources, including limits on Internet access and proper use of non-attribution Internet access.

(2) Judiciously approve and grant non-attribution Internet access to include briefing and monitoring employee’s internet usage to ensure that abuses of the system do not occur.

(3) Document and report instances of suspected misuse.

(4) Where warranted by results of an NGA-sponsored investigation, administer employee discipline.

i. NGA Internet users.

(1) Treat transmissions on the Internet as un-secure and use best judgment when using the Internet for personal use.

(2) Contact SR to obtain non-attribution accounts for the purpose of open source research for official business.

(3) Complete required training to maximize operational security when using the Internet for a mission related collection.

(4) Immediately report unusual network activity (undue or suspicious activity related to Internet accounts, external e-mail, or Internet use, including viruses or malicious code) to an IAO, specifying the name, date, time, system, network identities, specific type of activity, connection, and information involved.

(5) Release to the public (including Internet groups) only information (products, documents, or data sets) that has been authorized for public release as specified in NI 5720.1R10 (reference 3).

(6) Refer to OGC all requests from the general public for sensitive or specific NGA, Government, or other related information not otherwise publicly available or that may be determined to be releasable to the public consistent with NI 5750.2R7 (reference 4).

(7) Consult with OGC regarding any Internet activity that raises legal, ethical, or standards of conduct concerns. Respect the legal protections provided by copyright, license, and authorship of messages, programs, and data on the Internet.

(8) Ensure individual accountability and protect network access by not revealing passwords or otherwise sharing their Internet access accounts.

(9) Consistent with NI 8900.4R5 (reference 9) comply with Intelligence Oversight, operational security, and intellectual property laws and regulations

(10) Refers any concerns dealing with waste, fraud, and abuse of NGA network resources to OIG.

7. Procedures.

a. General. In the performance of their official duties, employees are provided access to NGA network resources, including the Internet. Official access to the internet is for the purpose of acquiring GEOINT, information related to GEOINT, and acquiring information related to assigned duties. Official use does not include soliciting persons to engage in HUMINT collection of information. Personnel requiring official access can request a non-attribution account from SR. SR provides guidance for exploiting and collecting from Internet sites when using a non-attribution account.

b. Official uses of Internet resources.

(1) Employees may use the Internet for official business. Employees must conduct official business on the Internet in non-attribution access mode when engaged in a search or collection for mission related intelligence information, and, where NGA’s interest in the subject is considered sensitive or might reveal classified topics of interest to NGA, or when exploiting a web site associated with a hostile organization. NGA employees using non-attribution accounts will contact SR regarding the procedure for downloading or purchasing GEOINT information.

Exploitation and harvesting of Internet sites is managed by SR. Collection of GEOINT from Internet sites which requires a logon identification and which is not commercial subscription must be approved by SR and OGC.

Use of a .com email address when accessing an Internet site in non-attribution mode is managed by SR and subject to approval by the Designated Accrediting Authority (DAA). Employees should not use non-attribution internet access and should use open NGA affiliated access when NGA is making a purchases, when the download is from a U.S.

educational institution or if NGA will receive a more beneficial access when open identity is used.

(2) When accessing the Internet in a non-attribution mode, an employee should only interact for the purpose of researching mission issues, collecting, or downloading GEOINT. When in non-attribution status employees should not make an online solicitation in order to conduct an activity distinct from direct analysis, collection, or downloading of GEOINT, or sign up for a conference or other activity. Employees must maintain anonymity when in a non-attribution mode and should not provide information which would jeopardize the non-attribution aspect of the access.

(3) When using government electronic resources, public blogging, discussions, and making comments on a topic which is mission related is not permitted without express supervisor approval. Mission related blogging and discussions are better suited for official Government networks where official mission related blogs or information sharing forums such as Intellipedia are located. . When making comments in an approved Internet blog, the employee should use the .mil address if participation requires an email address. Participating in an Internet blog or discussion as part of a NGA funded educational course or program, when the subject is not mission related, and, where NGA’s interest in the subject is not considered sensitive or might reveal classified topics of interest, and where the employee does not create the impression that the employee is a spokesperson for NGA, is permitted. When making comments in an Internet blog for an approved purpose, the employee should use the .mil address if participation requires an email address and should disclose their association with NGA if required by terms of the Internet site. Any comment or communication made from a NGA information system on a US academic institution website must be made with attribution to the NGA employee.

(4) Advanced and new Internet harvesting techniques which could collect personably identifiable information need approval by OGC prior to operational deployment.

(5) Employees participating in interagency programs where laptops or other collection platforms are used to collect from the Internet may be subject to additional rules and guidelines.

c. Personal use and access to the Internet resources.

1) Consistent with NI 5500.11R4 (reference 6), employees are authorized limited personal use of network resources and use of an NGA .mil email address for electronic communications. Personal use of official network resources can serve a legitimate public interest, such as keeping employees at their duty stations rather than requiring the use of commercial systems, improving morale of employees stationed for extended periods away from home, or enhancing professional skills.

Personal use of Internet resources should not adversely affect the performance of official duties, should be of reasonable duration and frequency, and whenever possible, made during the employee’s break time such as after duty hours or lunch periods.

(2) Use of an NGA email address account for a communication not related to official duties should be minimized. Reasonable personal use of an NGA email address includes purposes such as: communications with family members, schools, day care, or similar entities. Employees should exercise caution when using an email address as a personal or functional identifier on a website or as method to receive mass or custom communications such as automated news alerts.

d. Prohibited uses of NGA-sponsored Internet accounts. Misuse of Internet privileges is considered misconduct and is subject to administrative disciplinary action. Violators of criminal law are subject to prosecution through the criminal process. The prohibitions in this section may not apply to employees when accessing websites containing prohibited information when the purpose of access is to conduct supervisor approved mission related research to collect GEOINT or to conduct supervisor approved research about terrorist groups or other foreign groups whose activities impact the national security mission. Examples of prohibited uses include:

(1) Accessing pornographic sites or downloading images from such sites using NGA-sponsored accounts or computer equipment.

(2) Requesting, ordering, creating, downloading, viewing, storing, copying, or transmitting sexually explicit or sexually oriented materials or services for personal recreation or entertainment while utilizing NGA sponsored Internet accesses.

(3) Downloading unapproved software or playing computer games.

(4) Downloading or disseminating inappropriate material such as hate speech, crude jokes, or material that ridicules or disparages others on the basis of race, creed, sex, color, age, religion, disability, national origin, or sexual orientation.

(5) Business uses unrelated to the employee’s official role, including:

(a) Personal monetary gain (that is, “for-profit” or other activities;

or in support of a business activity);

(b) Unofficial participation in any non-NGA fund-raising activity;

(c) Endorsement of any product or service;

(d) Participation in lobbying activity;

(e) Any prohibited partisan political activity;

(6) Using NGA-sponsored networks or accesses for illegal or unethical purposes such as “hacking,” spreading viruses, or disrupting networks;

(7) Permitting anyone else to use one’s NGA-sponsored access;

(8) Using Government systems as a staging ground or platform to gain unauthorized access to other systems;

(9) Creating, copying, transmitting, or retransmitting chain letters or other unauthorized mass mailings regardless of the subject matter;

(10) Creating, downloading, viewing, storing, copying, or transmitting materials related to illegal gambling, illegal weapons, or any other illegal activities;

(11) Posting Agency information to external newsgroups, bulletin boards, or other public forums without authority as specified in NI 5720.1R10 (reference 3). Employees are specifically not authorized to create the impression that a communication was made in one’s official capacity as a Federal employee, unless NGA approval is obtained;

(12) Any use that generates unauthorized expenses to the Government;

(13) The unauthorized acquisition, use, reproduction, transmission, or distribution of any controlled information that includes:

(a) Privacy information;

(b) Material subject to intellectual property rights;

(c) Proprietary data;

(d) Export-controlled software or data;

(e) Network computer activities to be performed only by or under the supervision of system administrators or IAOs.

(14) Accessing external web mail without a waiver from the DAA or his delegate. Personnel requiring access must provide mission critical justification and documentation from their respective legal department.

(15) Manipulating internet default browser proxy settings to circumvent security settings. Alternate proxy settings are solely for non-attribution internet access or individuals with mission justification and authorization from the OCIO and the DAA.

(16) Forwarding (automatically or manually) sensitive unclassified information by e-mail to user’s home computer or contractor company computer without DAA authorization.

e. Accessing the Internet for an official purpose on a non-Government system.

(1) Use of the Internet when access is not dependent on (NGA) Government equipment for an official purpose, such as assigned research related to an official duty, requires supervisor approval. When an employee has approval to utilize the Internet on non-official equipment for official duties, the following types of information should not be utilized as part of approved Internet access:

a. Information subject to the Privacy Act and belonging to a person other than the person requesting to work on a non-official system;

b. Information subject to the Procurement Integrity Act;

c. Proprietary information unless written approval is received from the owner of the information or OGC;

d. Information needed for GEOINT analytic products or research, and, where NGA’s interest is sensitive or might reveal classified topics of interest to NGA.

Appendix 1

Secondary References

1. Intelligence Community Directive 301 National Open Source Enterprise July 11, 2006.

2. Federal CIO Council Limited Personal Use of Government Office Equipment Including Information Technology May 19, 1999.

3. NI 5720.1R10, NGA Instruction for Clearance for Public Release, 8 December 2008.

4. NI 5750.2R7, NGA Instruction for the Freedom of Information Act Program, 7 August 2007.

5. NI 8470.3R8, NGA Instruction for Use of Electronic Mail and Other Electronic Communications, 9 January 2006.

6. NI 5500.11R4, NGA Instruction for Standards of Conduct, 2 October 2008.

7. NI 8420.2R7, NGA Instruction for Serious Antivirus Response 12 October 2005.

8. NI 1455.1R5, NGA Instruction for Employee Adverse Action and Discipline, 28 November 2007.

9. NI 8900.4R5, NGA Instruction for Intelligence Oversight, 30 March 2006.

NGA Instruction forInternet Usage