Federal Register: December 29, 2006 (Volume 71, Number 250)
DOCID: FR Doc E6-22008
DEPARTMENT OF HOMELAND SECURITY
Homeland Security Department
Docket ID: [Docket No. DHS-2006-0076]
DOCUMENT ACTION: Notice of Privacy Act System of Records.
Privacy Act of 1974; System of Records
DATES: Written comments must be submitted on or before January 29, 2007.
In accordance with the Privacy Act of 1974, the Department of Homeland Security is giving notice that it proposes to add a new system of records to its inventory of record systems for Department of Homeland Security General Information Technology Access Account Records System.
Privacy Act; system of records,
As part of its efforts to streamline and consolidate its record system, the Department of Homeland Security (DHS) is establishing a new agencywide systems of records under the Privacy Act of 1974 (5 U.S.C. 552a) for the Department of Homeland Security General Information Technology Access Account Records System (GITAARS). This system of records is part of DHS's ongoing record integration and management efforts. This system will consist of information collected in order to provide authorized individuals with access to DHS information technology resources. This information includes user name, business affiliation, account information and passwords.
The Privacy Act embodies fair information principles in a statutory framework governing the means by which the U.S. Government collects, maintains, uses and disseminates personally identifiable information. The Act applies to information that is maintained in a ``system of records.'' A ``system of records'' is a group of any records under the control of an agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to the individual. The Privacy Act requires each agency to publish in the Federal Register a description of the type and character of each system of records that the agency maintains, and the routine uses for which such information may be disseminated and the purpose for which the system is maintained. Individuals may request their own records that are maintained in a system of records in the possession or under the control of DHS by complying with DHS Privacy Act regulations, 6 CFR Part 5.
In accordance with 5 U.S.C. 552a(r), a report on this system has been sent to Congress and to the Office of Management and Budget. DHS20060076
General Information Technology Access Account Records System, DHS/ ALL 004.
Unclassified but sensitive.
Records are maintained by the Department of Homeland Security at the DHS Data Center in Washington, DC, and at a limited number of remote locations where DHS components or program maintain secure facilities and conducts its mission.
Categories of individuals covered by the system:
A. All persons who are authorized to access DHS Information Technology resources, including employees, contractors, grantees, private enterprises and any lawfully designated representative of the above and including representatives of Federal, state, territorial, tribal, local, international, or foreign government agencies or entities, in furtherance of the DHS mission;
B. Individuals who serve on DHS boards and committees;
C. Individuals who have business with DHS and who have provided personal information in order to facilitate access to DHS Information Technology resources; and
D. Individuals who are facility points of contact for government business and the individual(s) they list as emergency contacts. Categories of records in the system:
DHS/ALL 004 contains names, business affiliations, facility
positions held, business telephone numbers, cellular phone numbers,
pager numbers, numbers where individuals can be reached while on travel
or otherwise away from the office, citizenship, home addresses,
electronic mail addresses, names and phone numbers of other contacts,
the positions or titles of those contacts, their business affiliations
and other contact information provided to the Department that is
derived from other sources to facilitate authorized access to DHS Information Technology resources.
Authority for maintenance of the system:
5 U.S.C. 301; 44 U.S.C. 3101.
This system will collect a discreet set of personal information in order to provide authorized individuals access to DHS information technology resources. The information collected by the system will include full name, user name, account information, citizenship, business affiliation, contact information, and passwords.
The system enables DHS to maintain: (a) Account information for
gaining access to information technology; (b) lists of individuals who
are appropriate organizational points of contact for the Department;
and (c) lists of individuals who are emergency points of contact. The
system will also enable DHS to provide individuals access to certain
programs and meeting attendance and where appropriate allow for sharing
of information between individuals in the same operational program to facilitate collaboration.
Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed outside DHS as a routine use pursuant to 5 U.S.C. 552a(b)(3), limited by privacy impact assessments, data sharing, or other agreements, as follows:
A. To DHS contractors, consultants or others, when necessary to perform a function or service related to this system of records for which they have been engaged. Such recipients are required to comply with the Privacy Act of 1974, as amended (5 U.S.C. 552a).
B. To sponsors, employers, contractors, facility operators, grantees, experts, and consultants in connection with establishing an access account for an individual and when necessary to accomplish a DHS mission function related to this system of records.
C. To other individuals in the same operational program supported by an information technology system, where appropriate notice to the individual has been made that his or her contact information will be shared with other members of the same operational program in order to facilitate collaboration.
D. To a Congressional office from the record of an individual in response to an inquiry from that Congressional office made at the written or attested to request of the individual to whom the record pertains.
E. To the National Archives and Records Administration or other Federal government agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. Sections 2904 and 2906.
F. To the Department of Justice (DOJ), or other Federal agency
conducting litigation or in proceedings before any court, adjudicative
or administrative body, when: (a) DHS; (b) any employee of DHS in his/
her official capacity; (c) any employee of DHS in his/her individual
capacity where DOJ or DHS has agreed to represent the employee; or (d)
the United States or any agency thereof, is a party to the litigation or has an interest in such litigation.
Disclosure to consumer reporting agencies:
Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:
Records in this system are on paper and/or in digital or other electronic form. Digital and other electronic images are stored on a storage area network in a secured environment.
Information may be retrieved by an identification number assigned by computer, by facility, by business affiliation, emails address, or by the name of the individual.
Information in this system is safeguarded in accordance with
applicable laws, rules and policies, including the DHS Information
Technology Security Program Handbook. Further, GITAARS security protocols will meet multiple NIST Security Standards from
Authentication to Certification and Accreditation. Records in the GITAARS will be maintained in a secure, password protected electronic system that will utilize security hardware and software to include: multiple firewalls, active intruder detection, and rolebased access controls. Additional safeguards will vary by component and program. All records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards. These safeguards include: restricting access to authorized personnel who have a ``need to know;'' using locks; and password protection identification features. Classified information is appropriately stored in accordance with applicable requirements. DHS file areas are locked after normal duty hours and the facilities are protected from the outside by security personnel.
Retention and disposal:
Records are retained and disposed of in accordance with the National Archives and Records Administration's General Records Schedule 24, section 6, ``User Identification, Profiles, Authorizations, and Password Files.'' Inactive records will be destroyed or deleted 6 years after the user account is terminated or password is altered, or when no longer needed for investigative or security purposes, whichever is later.
System manager(s) and address:
For Headquarters components of the Department of Homeland Security, the System Manager is the Director of Departmental Disclosure, U.S. Department of Homeland Security, Washington, DC 20528.
For operational components that comprise the U.S. Department of Homeland Security, the System Managers are as follows:
Administration, FOIA/PA System Manager, Office of Security, West Building, 4th Floor, Room 432N, TSA20, 601 South 12th Street, Arlington, VA 222024220.
To determine whether this system contains records relating to you, write to the appropriate System Manager(s) identified above. Record access procedures:
A request for access to records in this system may be made by
writing to the System Manager, identified above, in conformance with 6
CFR Part 5, Subpart B, which provides the rules for requesting access to Privacy Act records maintained by DHS.
Contesting record procedures:
Same as ``Records Access Procedures'' above.
Record source categories:
Information contained in this system is obtained from affected
individuals/organizations/facilities, public source data, other
government agencies and/or information already in other DHS records systems.
Exemptions claimed for the system:
Dated: December 18, 2006.
Hugo Teufel III,
Chief Privacy Officer.
[FR Doc. E622008 Filed 122806; 8:45 am]
BILLING CODE 441010P
FOR FURTHER INFORMATION CONTACT
Please identify by Docket Number DHS-
20060076 to request further information by one of the following methods: