United States Department of Justice, Federal Bureau of Investigation.
Notice of a Modified System of Records.
Pursuant to the Privacy Act of 1974 and Office of Management and Budget (OMB) Circular No. A-108, notice is hereby given that the Federal Bureau of Investigation (FBI), a component within the United States Department of Justice (DOJ), proposes to modify a system of records titled “Law Enforcement National Data Exchange” (N-DEx), JUSTICE/FBI-020, as to which notice was last published in the Federal Register on October 4, 2007 (Notice). The N-DEx System is a scalable information-sharing network that provides the capability for local, state, tribal, territorial, regional, federal, and foreign criminal justice agencies to make potential linkages between criminal justice incidents, investigations, arrests, bookings, incarcerations, parole and/or probation information, and criminal intelligence information, in order to help solve, deter, and prevent crimes, and, in the process, to enhance national security.
In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is applicable upon publication, subject to a 30-day period in which to comment on the routine uses, described below. Please submit any comments by January 16, 2019.
The public, OMB, and Congress are invited to submit any comments: by mail to DOJ, Office of Privacy and Civil Liberties, ATTN: Privacy Analyst, National Place Building, 1331 Pennsylvania Ave. NW, Suite 1000, Washington, DC 20530-0001; by facsimile at 202-307-0693; or by email at firstname.lastname@example.org. To ensure proper handling, please reference the above CPCLO Order No. on your correspondence.
Start Further Info
FOR FURTHER INFORMATION CONTACT:
Katherine Bond, Assistant General Counsel, Privacy and Civil Liberties Unit, Office of the General Counsel, FBI, 935 Pennsylvania Avenue NW, Washington, DC 20535-0001; telephone 202-324-3000.
End Further Info
Start Supplemental Information
The FBI has revised this system of records to update the purpose and uses of the system, the type of information maintained by the system, the sources of information, and the retrieval capabilities of information from the system.
The FBI is modifying the name of this system of records from “Law Enforcement National Data Exchange” to “National Data Exchange System” (N-DEx System). This name change reflects a previously implemented FBI policy decision to remove “law enforcement” from the title of the system to reflect more accurately the use of the N-DEx System by all criminal justice agencies. Similarly, to provide greater transparency on the use of the system of records, the term “law enforcement” within the existing notice is being changed to “criminal justice” generally. “Administration of criminal justice,” as defined by federal regulation, encompasses the performance of a broader array of activities than those performed only by sworn law enforcement officers, and include probation/parole, correctional supervision, prosecution, and rehabilitation of accused persons or criminal offenders. Criminal justice agencies also include courts and government agencies performing the administration of criminal justice functions. See 28 CFR 20.3(b) and (g).
Despite changes to the system as described in this notice, the FBI continues to assert, and is not changing the Privacy Act exemptions for the system promulgated by Final Rule at 73 FR 9947 (Feb. 25, 2008). As stated in that Final Rule, these Privacy Act exemptions apply only to the extent that information in the system is within the scope of 5 U.S.C. 552a(j)(2), and to the extent it is, the rationale for asserting the exemptions has not changed. Although the name of this system of records is changing slightly pursuant to this Notice, the exemptions as stated in 73 FR 9947 (Feb. 25, 2008) under the prior name of this system continue to apply under the new name. When changes to the exemptions for this system become necessary, FBI will at that time indicate as part of the rule change that the name of the system has changed slightly.
The FBI is also updating the purpose and routine uses of the Notice to reflect the expanded purpose of the N-DEx System to provide records to criminal justice agencies for criminal justice employment background checks; firearms, explosive, and associated license/permit-related background checks; and security risk assessments conducted on individuals seeking access to select biological agents or toxins pursuant to 42 U.S.C. 262a and 42 CFR 73.10. In addition, the updated purpose reflects the use of the N-DEx System for federal suitability and fitness determinations as contemplated in Executive Order 13467, as amended by Executive Order 13764. These expanded uses of the N-DEx System promote public safety by ensuring that a prospective employee's involvement in the criminal justice system is known before a criminal justice employee or federal employee is hired. Likewise, expanding the use of the N-DEx System for firearm, explosive, and associated license/permit-related checks and security risk assessments provides access to additional criminal justice information relevant to determining if a potential purchaser is prohibited by state or federal law from receiving a firearm, explosive, or associated permit or if an applicant is legally restricted from accessing select biological agents or toxins. For consolidation purposes, the routine uses applicable to the N-DEx System under the FBI's Blanket Routine Uses (FBI-BRU, 66 FR 33558 (June 22, 2001), as amended by 70 FR 7513, 517 (Feb. 14, 2005) and 82 FR 24147 (May 25, 2017)), are also being included in the routine use portion of this notice.
Additional changes are being made to this Notice to provide greater clarity about the information contained in the N-DEx System and the types of information that can be retrieved for criminal justice purposes by the N-DEx System. Expanding the N-DEx System to include records retrieved via a federated search of additional criminal justice information and criminal intelligence databases increases criminal justice agencies' access to information necessary for them to perform their legally authorized, required functions.
In accordance with 5 U.S.C. 552a(r), the DOJ has provided a report to OMB and the Congress on this revised system of records.
Start Printed Page 64602
Dated: December 11, 2018.
Peter A. Winn
Acting Chief Privacy and Civil Liberties Officer, United States Department of Justice.
SYSTEM NAME AND NUMBER:
National Data Exchange System (N-DEx System), JUSTICE/FBI-020.
Sensitive But Unclassified.
Records will be located at the Federal Bureau of Investigation (FBI), Criminal Justice Information Services (CJIS) Division, 1000 Custer Hollow Road, Clarksburg, WV 26306, and at appropriate locations for system backup and continuity of operations purposes. Records may also be maintained in secure cloud computing environments. The cloud computing service provider on the date of this publication is Amazon Web Services, located at 12900 Worldgate Drive, Herndon, VA 20170. Cloud computing service providers may change. For information about the current cloud computing service provider, please contact the Unit Chief, Privacy and Civil Liberties Unit, Office of the General Counsel, FBI, 935 Pennsylvania Avenue NW, Washington, DC 20535-0001; telephone 202-324-3000.
Director, Federal Bureau of Investigation, 935 Pennsylvania Avenue NW, Washington, DC 20535-0001; telephone 202-324-3000.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The system is established and maintained in accordance with 28 U.S.C. 533, 534; 28 CFR 0.85 and 28 CFR part 20.
PURPOSE(S) OF THE SYSTEM:
The purpose of the N-DEx System is to enhance the interconnectivity of criminal justice databases in various agencies and jurisdictions in order to improve the sharing of multiple levels of criminal justice data to further objectives for crime analysis, criminal justice administration (“administration of criminal justice” is defined at 28 CFR 20.3(b)), and strategic/tactical operations in investigating, reporting, solving, and preventing crime, and, thereby, improving national security. The N-DEx System provides local, state, tribal, territorial, regional, federal, foreign criminal justice, and limited authorized noncriminal justice agencies with a powerful investigative tool to link, share, search, and analyze criminal justice information, including incident/case reports, incarceration data, and parole/probation data. In addition to containing information submitted by criminal justice agencies and jurisdictions nationwide (as will be detailed below in this Notice), the N-DEx System facilitates the sharing of criminal justice and criminal intelligence information (“criminal intelligence information” is defined at 28 CFR 23.3(b)(3)) controlled and maintained by many different agencies and jurisdictions nationwide. As well as facilitating information sharing for investigative purposes, the N-DEx System also facilitates such sharing for criminal justice employment background checks; federal suitability and fitness determinations for covered individuals as defined in Executive Order 13467, as amended by Executive Order 13764; security risk assessments on individuals applying for access to select biological agents and toxins as set forth in 42 U.S.C. 262a and 42 CFR 73.10; and firearms, explosives, and associated license/permit-related background checks conducted by criminal justice agencies.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The N-DEx System contains information maintained by the FBI about the following types of individuals:
A. Any individual who is identified in a criminal justice report concerning a criminal justice incident or investigation. These individuals include, but are not limited to: Subjects; suspects; associates; victims; persons of interest; witnesses; and/or any individual named in pre-trial investigations and arrest, booking, incident, incarceration, parole, and probation reports.
B. N-DEx System users and individuals listed as the point of contact for records in the N-DEx System.
C. Individuals who have been queried through the N-DEx System. In addition to information about the above individuals that is actually maintained by the system, the N-DEx System also facilitates access to information not maintained by the FBI, but that is contained in non-FBI databases (controlled by local, state, tribal, territorial, regional, and other federal agencies) that can be searched via functionality of the N-DEx System. The information in systems controlled or maintained by other agencies or jurisdictions will include information about the categories of individuals described in (A) above, but will also include information about individuals identified in criminal intelligence information (defined at 28 CFR 23.3(b)(3)). These individuals may include, but are not limited to, subjects, suspects, associates, victims, persons of interest, witnesses, and/or any individual named in a criminal intelligence product or report.
Information about individuals maintained in local, state, tribal, territorial, regional, federal (non-Department of Justice), and foreign criminal justice databases, and merely accessed via N-DEx System search are not part of the N-DEx System system of records because they are not “under the control of” the Department as stated in the Privacy Act definition of “system of records.” 5 U.S.C. 552a(a)(5).
CATEGORIES OF RECORDS IN THE SYSTEM:
The N-DEx System contains information collected by criminal justice agencies that is needed for the performance of their legally authorized, required functions. The records in the N-DEx System span the entire criminal justice lifecycle and consist of arrest, holding, incident, supervised release, booking, incarceration, service call, case and warrant reports; pre-trial investigation reports; missing persons reports; parole and/or probation information; other information collected by criminal justice agencies; and information shared for collaboration purposes from local, state, tribal, territorial, regional, federal, and foreign criminal justice entities. Identifying information in the N-DEx System includes, but is not limited to: Name(s); sex; race; citizenship; date and place of birth; address(es); telephone number(s); social security number(s) or other unique identifiers; physical description, including height, weight, hair color, eye color, gender; occupation and vehicle identifiers; and photographs. Records from the FBI's CJIS Division systems, including the National Crime Information Center (NCIC), the Interstate Identification Index (III), and the Next Generation Identification (NGI) Systems, will be made available to the N-DEx System for queries, but the N-DEx System will not contain copies of these databases. Additionally, records from other criminal justice and criminal intelligence databases controlled and updated by local, state, tribal, territorial, regional, federal, and foreign criminal justice entities or non-governmental agencies will be made accessible for queries via the N-DEx System, but because the FBI and DOJ will not control or update the records from these databases, this information will not be considered part of the N-DEx System system of records.
Records maintained in the N-DEx System about individuals described in category “B” of INDIVIDUALS Start Printed Page 64603COVERED BY THE SYSTEM above include name, userID, phone number, email address, associated identity provider, employing agency, and information users voluntarily provide for collaboration purposes.
The N-DEx System also maintains an audit log of searches conducted in the N-DEx System and records viewed as a result of each search. The audit log includes search criteria that may include identifying information (e.g. name, date of birth, social security number) about individuals described in category “C” of INDIVIDUALS COVERED BY THE SYSTEM above.
RECORD SOURCE CATEGORIES:
Information contained in the N-DEx System is obtained from local, state, tribal, territorial, regional, federal, and foreign criminal justice agencies and non-governmental agencies that compile information for criminal justice purposes.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:
As part of those disclosures generally permitted under 5 U.S.C. 552a(b), the records in this system may be disclosed as a routine use, under 5 U.S.C. 552a(b)(3) to the following persons or entities and under the circumstances or for the purposes described below:
A. To any criminal, civil, or regulatory authority (whether local, state, tribal, territorial, regional, federal, or foreign) where the information is relevant to the recipient entity's criminal justice responsibilities.
B. To a local, state, tribal, territorial, regional, federal, foreign, international, or other public agency/organization, or to any person or entity in either the public or private sector, domestic or foreign, where such disclosure may facilitate the apprehension of fugitives, the location of missing persons, the location and/or return of stolen property or similar criminal justice objectives.
C. To local, state, tribal, territorial, regional, or federal criminal justice agencies for the performance of firearms, explosives, or associated license/permit-related background checks.
D. To federal agencies for the performance of federal suitability or fitness determinations under the authority of Executive Order 13467 as amended by Executive Order 13764.
E. To federal agencies in connection with a security risk assessment conducted, pursuant to 42 U.S.C. 262a and 42 CFR 73.10, on an individual applying for access to select biological agents or toxins.
F. To a local, state, tribal, territorial, regional, federal, or foreign governmental entity lawfully engaged in collecting law enforcement, law enforcement intelligence, national security information, homeland security information, national intelligence, possible national security threat information, or terrorism information for law enforcement, intelligence, national security, homeland security, or counterterrorism purposes.
G. To any person or entity in either the public or private sector, domestic or foreign, if deemed by the FBI to be reasonably necessary to elicit information or cooperation from the recipient for use in furthering the purposes of the system.
H. To appropriate agencies, entities, and persons when (1) the Department suspects or has confirmed that there has been a breach of the system of records; (2) the Department has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, DOJ (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.
I. To another Federal agency or Federal entity, when the Department determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.
J. To those agencies, entities, and persons the FBI may consider necessary or appropriate in ensuring the continuity of government functions in the event of any actual or potential significant disruption of normal government operations. This also includes all related pre-event planning, preparation, backup/redundancy, training and exercises, and post-event operations, mitigation, and recovery.
K. If any system record, on its face or in conjunction with other information, indicates a violation or potential violation of law (whether civil or criminal), regulation, rule, order, or contract, the pertinent record may be disclosed to the appropriate entity (whether federal, state, local, joint, tribal, foreign, or international), that is charged with the responsibility of investigating, prosecuting, and/or enforcing such law, regulation, rule, order, or contract.
L. To contractors, grantees, experts, consultants, students, or others performing or working on a contract, service, grant, cooperative agreement, or other assignment for the Federal Government, when necessary to accomplish an agency function.
M. To the news media or members of the general public in furtherance of a legitimate law enforcement or public safety function as determined by the FBI, e.g., to assist in locating fugitives; to provide notifications of arrests; to provide alerts, assessments, or similar information on potential threats to life, health, or property; or to keep the public appropriately informed of other law enforcement or FBI matters or other matters of legitimate public interest where disclosure could not reasonably be expected to constitute an unwarranted invasion of personal privacy. (The availability of information in pending criminal or civil cases will be governed by the provisions of 28 CFR 50.2.)
N. To a court or adjudicative body, in matters in which (a) the FBI or any FBI employee in his or her official capacity, (b) any FBI employee in his or her individual capacity where the Department of Justice has agreed to represent the employee, or (c) the United States, is or could be a party to the litigation, is likely to be affected by the litigation, or has an official interest in the litigation, and disclosure of system records has been determined by the FBI to be arguably relevant to the litigation. Similar disclosures may be made in analogous situations related to assistance provided to the Federal Government by non-FBI employees (see Routine Use L).
O. To an actual or potential party or his or her attorney for the purpose of negotiating or discussing such matters as settlement of the case or matter, or informal discovery proceedings, in matters in which the FBI has an official interest and in which the FBI determines records in the system to be arguably relevant.
P. To such recipients and under such circumstances and procedures as are mandated by Federal statute or treaty.
Q. To a Member of Congress or a person on his or her staff acting on the Member's behalf when the request is made on behalf and at the request of the individual who is the subject of the record.
R. National Archives and Records Administration (NARA) Records Start Printed Page 64604Management. To the National Archives and Records Administration (NARA) for records management inspections and such other purposes conducted under the authority of 44 U.S.C. 2904 and 2906.
S. To any agency, organization, or individual for the purposes of performing authorized audit or oversight operations of the FBI and meeting related reporting requirements.
T. The DOJ may disclose relevant and necessary information to a former employee of the Department for purposes of: Responding to an official inquiry by a federal, state, or local government entity or professional licensing authority, in accordance with applicable Department regulations; or facilitating communications with a former employee that may be necessary for personnel-related or other official purposes where the Department requires information and/or consultation assistance from the former employee regarding a matter within that person's former area of responsibility. (Such disclosures will be effected under procedures established in title 28, Code of Federal Regulations, sections 16.300-301 and DOJ Order 2710.8C, including any future revisions.)
U. To the White House (the President, Vice President, their staffs, and other entities of the Executive Office of the President (EOP)), and, during Presidential transitions, the President-Elect and Vice-President Elect and their designees for appointment, employment, security, and access purposes compatible with the purposes for which the records were collected by the FBI, e.g., disclosure of information to assist the White House in making a determination whether an individual should be: (1) Granted, denied, or permitted to continue in employment on the White House Staff; (2) given a Presidential appointment or Presidential recognition; (3) provided access, or continued access, to classified or sensitive information; or (4) permitted access, or continued access, to personnel or facilities of the White House/EOP complex. System records may be disclosed also to the White House and, during Presidential transitions, to the President Elect and Vice-President Elect and their designees, for Executive Branch coordination of activities which relate to or have an effect upon the carrying out of the constitutional, statutory, or other official or ceremonial duties of the President, President Elect, Vice-President or Vice-President Elect.
V. To complainants and/or victims to the extent deemed appropriate by the FBI to provide such persons with information and explanations concerning the progress and/or results of the investigations or cases arising from the matters of which they complained and/or of which they were victims.
W. To appropriate officials and employees of a federal agency or entity which requires information relevant to a decision concerning the hiring, appointment, or retention of an employee; the issuance, renewal, suspension, or revocation of a security clearance; the execution of a security or suitability investigation; the letting of a contract; or the issuance of a grant or benefit.
X. To designated officers and employees of local, state, (including the District of Columbia), or tribal law enforcement or detention agencies in connection with the hiring or continued employment of an employee or contractor, where the employee or contractor would occupy or occupies a position of public trust as a law enforcement officer or detention officer having direct contact with the public or with prisoners or detainees, to the extent that the information is relevant and necessary to the recipient agency's decision.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Most information is maintained in electronic form and stored in computer memory, on disk storage, on computer tape, in a government approved cloud computing infrastructure (e.g., FedRAMP approved) offered by a cloud service provider (e.g. Amazon Web Services), or on other computer media. However, some information may also be maintained by the contributing agency in hard copy (paper) or other form.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Information will be retrieved from the N-DEx System by keyword search and linkages based on identifying data collected on involved persons, places and things, and other non-specific descriptions of circumstances to identify common or similar events. This could include individual names or other personal identifiers. In addition to returning records based upon a direct query of the N-DEx System, N-DEx System records may also be retrieved by a query made to other authorized interoperable systems when the users of the other systems would also be authorized to access the N-DEx System.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
The information within the N-DEx System will be contributed by local, state, tribal, territorial, regional, federal, and foreign criminal justice entities. Records in the N-DEx System are restricted to information obtained by criminal justice agencies in connection with their official duties administering criminal justice. All entities are responsible for ensuring the relevance and currency of the information they contribute to the N-DEx System and will have control and responsibility for the disposition of their own records through a process that is documented by the N-DEx Policy and Operating Manual, or based upon federal law. The N-DEx Policy and Operating Manual requires that before taking action on an N-DEx System record, agencies verify the accuracy and completeness of the record with the record owner. Policy also dictates that record contributors update their records at least monthly. Those portions of the N-DEx System that constitute federal records are subject to applicable retention schedules approved by the National Archives and Records Administration (NARA). In addition, the N-DEx System itself will result in the creation of metadata or an audit log that reflects any correlation between any of the submitted records, as well as information about user activity. The N-DEx System metadata or audit logs will be retained for 25 years, or as otherwise specified in the NARA schedule, Job No. N1-065-11-2.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
N-DEx System records are maintained in limited access space in FBI controlled facilities and offices or in secure cloud-computing environments. Computerized data is password protected. Information in the cloud is stored in a government approved cloud computing infrastructure (e.g., FedRAMP approved) offered by a cloud service provider. All communications between the FBI infrastructure and the cloud service provider are encrypted both in transit and at rest to comply with Trusted Internet Connection (TIC) requirements and security best practices. All FBI personnel are required to pass extensive background investigations. N-DEx System information is accessed only by authorized DOJ personnel, or by non-DOJ personnel properly authorized to assist in the conduct of an agency function related to these records. The N-DEx System has adequate physical security and built in controls to protect against unauthorized personnel gaining access to the equipment and/or the information stored in it.Start Printed Page 64605
RECORD ACCESS PROCEDURES:
Because the N-DEx System contains records compiled to assist with the enforcement of criminal laws, the records in this system have been exempted from notification, access, and amendment to the extent permitted by subsection (j) of the Privacy Act. An individual who is the subject of one or more records in this system may be notified of records that are not exempt from notification and, accordingly, may access those records that are not exempt from disclosure. All requests for access should follow the guidance provided on the FBI's website at https://www.fbi.gov/services/records-management/foipa. A request for access to a record from this system of records must be submitted in writing and comply with 28 CFR part 16. Individuals may mail, fax, or electronically submit a request, clearly marked “Privacy Act Access Request,” to the FBI, ATTN: FOI/PA Request, Record/Information Dissemination Section, 170 Marcel Drive, Winchester, VA 22602-4843; facsimile: 540-868-4995/6/7; electronically: https://www.fbi.gov/services/records-management/foipa/requesting-fbi-records. The request should include a general description of the records sought, and must include the requester's full name, current address, and date and place of birth. The request must be signed and dated and either notarized or submitted under penalty of perjury. While no specific form is required, requesters may obtain a form (Form DOJ-361) for use in certification of identity, which can be located at the above link. In the initial request, the requester may also include any other identifying data that the requester may wish to furnish to assist the FBI in making a reasonable search. The request should include a return address for use by the FBI in responding; requesters are also encouraged to include a telephone number to facilitate FBI contacts related to processing the request. A determination of whether a record may be accessed will be made after a request is received.
CONTESTING RECORD PROCEDURES:
To contest or amend information maintained in the N-DEx System, an individual should direct his/her request to the address provided above, stating clearly and concisely what information is being contested, the reasons for contesting it, and the proposed amendment to the information sought.
Some information may be exempt from contesting record procedures as described in the section titled “Exemptions Claimed for the System.” An individual who is the subject of one or more records in this system may contest and pursue amendment of those records that are not exempt. A determination whether a record may be subject to amendment will be made at the time a request is received.
Same as RECORD ACCESS PROCEDURES paragraph, above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
The Attorney General has exempted the N-DEx System from subsection (c)(3) and (4); (d)(1), (2), (3) and (4); (e)(1), (2), (3), (5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2). Rules have been promulgated in accordance with the requirements of 5 U.S.C. 553(b), (c), and (e). See 28 CFR 16.96(t) and (u).
Law Enforcement National Data Exchange System (N-DEx), JUSTICE/FBI-020, 77 FR 56793 (Oct. 4, 2007), as amended by 82 FR 24151, 157 (May 25, 2017).
End Supplemental Information
[FR Doc. 2018-27265 Filed 12-14-18; 8:45 am]
BILLING CODE 4410-02-P