Atch_J-5_PSNS IMF_Notice_5239.pdf

DEPARTMENT OF THE NAVY

P U G E T S O U N D N A V A L S H I P Y A R D A N D I N T E R M E D I A T E M A I N T E N A N C E F A C I L I T Y

1 4 0 0 F A R R A G U T A V E N U E B R E M E R T O N , W A S H I N G T O N 9 8 3 1 4 - 5 0 0 1

I N R E P L Y R E F E R T O :

PSNS&IMFNOTE 5239

Code 1230 4 May 2010

PSNS&IMF NOTICE 5239

Canc: May 11

From: Commander, Puget Sound Naval Shipyard and Intermediate Maintenance Facility

Subj: PORTABLE ELECTRONIC DEVICE (PED) GUIDANCE

Ref: (a) PSNS&IMFINST 2100.7, Telecommunications Plan for

Safeguarding Naval Nuclear Propulsion Information (NNPI) while working at Commander Fleet Activities Yokosuka, Japan

(b) NAVSEAINST 5239.2A, NAVSEA Information Assurance Program

(c) PSNS&IMFINST 5239.2C, Information Assurance (IA) Policy

(d) PSNS&IMFINST 2300.3B, Cell Phone Procedures

(e) NAVSHIPYDPUGETINST 5510.1G, Information and Personnel

Security Program Manual

(f) PSNS&IMFINST P5530.1A, Physical Security Plan (PSP)

(g) SECNAV M-5210.1, Department of the Navy Records

Management Program

Encl: (1) Personally Owned PED Functionality Matrix

1. Purpose. To provide amplifying guidance for references (a) through (f), relating to Portable Electronic Device (PED) use within Puget Sound Naval Shipyard and Intermediate Maintenance Facility (PSNS & IMF) sites, buildings, and offices.

2. Applicability. This policy applies to all military, civilian, and contractor personnel working at any PSNS & IMF site. Additional guidance for personnel assigned permanently or on Temporary Duty (TDY) assignment to PSNS & IMF Detachment Yokosuka is contained in reference (a). Example devices and functionalities included under this guidance can be found in enclosure (1).

3. Background. Portable Electronic Device (PED) is a generic term used to describe commercially-available portable or hand-held electronic devices commonly used both within the workplace and for personal use. While these devices can increase

PSNS&IMFNOTE 5239

4 May 2010 productivity and enhance quality of life, they can also increase the risk of compromise of classified data and Controlled Unclassified Information (CUI). Size and portability can contribute to the loss of physical control of the device, while wireless interfaces, such as cellular, infrared, and Bluetooth provide the means to deliver malicious software. Electronic eavesdropping software can remotely turn on a PED’s microphone, allowing conversations to be overheard or recorded.

Additionally, PED users may inadvertently capture classified or CUI data/information in the background of audio or video recordings or transmissions. Due to these vulnerabilities and other risks posed by the use of PEDs at PSNS & IMF facilities, appropriate measures are required to safeguard the confidentiality, integrity, and availability of information which, if disclosed, could damage or harm the security of the United States.

4. Policy

a. Reference (b), paragraph 8n(1)(b), states that personally owned PEDS are prohibited at all NAVSEA facilities unless specifically authorized by the Local Approving Authority (LAA). At PSNS & IMF, the LAA is the Shipyard Commander.

Policy for use of personal and government-owned PEDs at PSNS & IMF is contained in reference (c).

b. Government-owned PEDs must be procured through Code 1230. They will be configured to be compliant with all security requirements per references (c) and (d).

c. Personally owned devices are not managed in accordance with the same strict configuration rules of government-owned devices, and as such their presence must be carefully controlled at PSNS & IMF work sites and offices. The policies regarding PEDs at PSNS & IMF have been created based on reference regulations, consideration of functionality, risks to the DOD network and data, and the following basic principles:

(1) All PEDS present a risk to DOD information. Their use is often restricted in unclassified areas and their use or possession may be prohibited in a classified environment.

(2) A personally owned device must never connect to a government device for any reason.

(3) Personally owned, allowed PEDs at PSNS & IMF work sites and offices must never contain the ability to take a picture or capture an image.

(4) Personally owned devices must never be used to transmit or connect to any wireless network with the exception of standard wireless cell phone protocols.

(5) A personally owned device may never be used to record voice, data, or image.

(6) A personally owned device may never process government information.

(7) PEDS can create distractions or impose a safety hazard on and off the job site.

d. Constant technological advancements available on PEDs complicates/precludes the creation of a comprehensive reference that details every scenario encountered in PSNS & IMF workspaces. Workplace supervision should consider the core principles identified in paragraph 4c when encountering situations involving PEDs. Enclosure (1) serves as an aid that reflects existing policies but does not cover all situations.

e. All PEDs are prohibited within 10 feet of any area in which classified information is being processed, transmitted, received, and where classified work is being performed unless specifically authorized in writing. Examples include, but are not limited to, SIPRNET rooms and NNPPNET workstation areas.

f. In certain designated restricted areas, additional PED prohibitions may be posted which are more restrictive than the guidance provided in this notice. PSNS & IMF personnel will comply with the more restrictive of the guidance/direction provided.

g. Instances of non-compliance with these requirements should be reported to the supervisor and/or Department Security Coordinator. PEDs which have been in violation of policy or subjected to electronic spills must be evaluated by Code 1230 prior to release from PSNS & IMF control.

5. Point of Contact. The local point of contact for this matter is the PSNS & IMF Information Assurance Manager, who can be reached at (360) 476-5188, DSN 439-5188.

6. Records Management. Records created as a result of this notice, regardless of media and format, shall be managed in accordance with reference (g).

/s/

M. R. WHITNEY

DISTRIBUTION:

NAVSHIPYDPUGETINST P5215.1M

Lists A, B, and T

Copy to:

1140.3 1141.2

NAVIMFAC PACNORWEST (Code 814)

Enclosure (1)

PERSONALLY OWNED PED FUNCTIONALITY MATRIX

PED Functionality/Device Type Example Device All PSNS & IMF Work

Areas

Within 10 ft of Classified

Information/Work Any photographic or image capturing capability

Camera, Video Recorder, Camera Cell Phone, Scanner

Prohibited Prohibited

Single-function cell phone 1 Allowed Prohibited Multi-function cell phone 2 Smart-phone (Blackberry) Allowed Prohibited Wireless transmitting capabilities WIFI, 802.xx, Bluetooth Allowed if turned off Prohibited

Wireless Peripheral Bluetooth Ear-Bud Allowed if turned off and not worn

Prohibited

RF receivers Pager, AM/FM Radio, Satellite Radio

Allowed Allowed

RF transmitter 3, 4 RF Radio Transceiver, Walkie-talkie

Written Approval Required 4

Prohibited

Primary function audio recording devices Digital voice recorders Prohibited Prohibited Play-Only Devices without removable memory 5

MP3 players, CD Players, Digital Picture Frames, Digital Books

Allowed Prohibited

Removable storage media 6 Memory Sticks, Thumb Drives, Flash Memory, SD Card

Prohibited Prohibited

PEDs capable of connecting to government-owned systems without interface cables or cradles

Built-in USB Adapter Prohibited Prohibited

Cables and cradles for privately owned PEDs connecting to a computer system

MP3 Player to USB Cable Prohibited Prohibited

1 Single-function cell phones are defined as cellular devices with no additional photographic or network capabilities (can only be used for voice or text message communications over a cellular network, storage of speed dial caller ID information, and limited voice recording). SIM cards/embedded memory for cell phones are permitted.

2 PEDs with more than one functionality are controlled based on the most restrictive capability identified in this enclosure.

3 An RF transmitter is defined as any radio frequency transmitter with the exception of single-function cell phones, which are addressed separately.

4 Amateur Radio Emergency Service (ARES)/Radio Amateur Civil Emergency Service (RACES) members must be approved in writing IAW ref (e) to carry hand-held transceivers.

5 CD Players capable of playing CD, CD-R, CD-RW, and MP3 formats are permitted. Only commercially produced media is allowed. No personally produced audio CDs are allowed within any PSNS & IMF facility.

6 The use of personally owned PEDs to process and/or store government data/information is prohibited.