General Information Technology Access Account Records

[Federal Register: December 29, 2006 (Volume 71, Number 250)]

[Notices]

[Page 78446-78448]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr29de06-85]

=======================================================================

-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Office of the Secretary

[Docket No. DHS-2006-0076]

Privacy Act of 1974; System of Records

AGENCY: Privacy Office, DHS.

ACTION: Notice of Privacy Act System of Records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Department of

Homeland Security is giving notice that it proposes to add a new system

of records to its inventory of record systems for Department of

Homeland Security General Information Technology Access Account Records

System.

DATES: Written comments must be submitted on or before January 29,

2007.

ADDRESSES: You may submit comments, identified by Docket Number DHS-

2006-0076 by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulations.gov.

Follow the instructions for submitting comments.

Fax: 202-572-8727 (not a toll-free number).

Mail: Hugo Teufel III, Chief Privacy Officer, Privacy

Office, Department of Homeland Security, Washington, DC 20528.

FOR FURTHER INFORMATION CONTACT: Please identify by Docket Number DHS-

2006-0076 to request further information by one of the following

methods:

Mail: Hugo Teufel III, Chief Privacy Officer, Privacy

Office, Department of Homeland Security, Washington, DC 20528.

[[Page 78447]]

Facsimile: 202-572-8727 (not a toll-free number).

E-Mail: privacy@dhs.gov.

SUPPLEMENTARY INFORMATION: As part of its efforts to streamline and

consolidate its record system, the Department of Homeland Security

(DHS) is establishing a new agency-wide systems of records under the

Privacy Act of 1974 (5 U.S.C. 552a) for the Department of Homeland

Security General Information Technology Access Account Records System

(GITAARS). This system of records is part of DHS's ongoing record

integration and management efforts. This system will consist of

information collected in order to provide authorized individuals with

access to DHS information technology resources. This information

includes user name, business affiliation, account information and

passwords.

The Privacy Act embodies fair information principles in a statutory

framework governing the means by which the U.S. Government collects,

maintains, uses and disseminates personally identifiable information.

The Act applies to information that is maintained in a ``system of

records.'' A ``system of records'' is a group of any records under the

control of an agency from which information is retrieved by the name of

an individual or by some identifying number, symbol, or other

identifying particular assigned to the individual. The Privacy Act

requires each agency to publish in the Federal Register a description

of the type and character of each system of records that the agency

maintains, and the routine uses for which such information may be

disseminated and the purpose for which the system is maintained.

Individuals may request their own records that are maintained in a

system of records in the possession or under the control of DHS by

complying with DHS Privacy Act regulations, 6 CFR Part 5.

In accordance with 5 U.S.C. 552a(r), a report on this system has

been sent to Congress and to the Office of Management and Budget.

DHS-2006-0076

System name:

General Information Technology Access Account Records System, DHS/

ALL 004.

Security classification:

Unclassified but sensitive.

System location:

Records are maintained by the Department of Homeland Security at

the DHS Data Center in Washington, DC, and at a limited number of

remote locations where DHS components or program maintain secure

facilities and conducts its mission.

Categories of individuals covered by the system:

A. All persons who are authorized to access DHS Information

Technology resources, including employees, contractors, grantees,

private enterprises and any lawfully designated representative of the

above and including representatives of Federal, state, territorial,

tribal, local, international, or foreign government agencies or

entities, in furtherance of the DHS mission;

B. Individuals who serve on DHS boards and committees;

C. Individuals who have business with DHS and who have provided

personal information in order to facilitate access to DHS Information

Technology resources; and

D. Individuals who are facility points of contact for government

business and the individual(s) they list as emergency contacts.

Categories of records in the system:

DHS/ALL 004 contains names, business affiliations, facility

positions held, business telephone numbers, cellular phone numbers,

pager numbers, numbers where individuals can be reached while on travel

or otherwise away from the office, citizenship, home addresses,

electronic mail addresses, names and phone numbers of other contacts,

the positions or titles of those contacts, their business affiliations

and other contact information provided to the Department that is

derived from other sources to facilitate authorized access to DHS

Information Technology resources.

Authority for maintenance of the system:

5 U.S.C. 301; 44 U.S.C. 3101.

Purpose(s):

This system will collect a discreet set of personal information in

order to provide authorized individuals access to DHS information

technology resources. The information collected by the system will

include full name, user name, account information, citizenship,

business affiliation, contact information, and passwords.

The system enables DHS to maintain: (a) Account information for

gaining access to information technology; (b) lists of individuals who

are appropriate organizational points of contact for the Department;

and (c) lists of individuals who are emergency points of contact. The

system will also enable DHS to provide individuals access to certain

programs and meeting attendance and where appropriate allow for sharing

of information between individuals in the same operational program to

facilitate collaboration.

Routine uses of records maintained in the system, including categories

of users and the purposes of such uses:

In addition to those disclosures generally permitted under 5 U.S.C.

552a(b) of the Privacy Act, all or a portion of the records or

information contained in this system may be disclosed outside DHS as a

routine use pursuant to 5 U.S.C. 552a(b)(3), limited by privacy impact

assessments, data sharing, or other agreements, as follows:

A. To DHS contractors, consultants or others, when necessary to

perform a function or service related to this system of records for

which they have been engaged. Such recipients are required to comply

with the Privacy Act of 1974, as amended (5 U.S.C. 552a).

B. To sponsors, employers, contractors, facility operators,

grantees, experts, and consultants in connection with establishing an

access account for an individual and when necessary to accomplish a DHS

mission function related to this system of records.

C. To other individuals in the same operational program supported

by an information technology system, where appropriate notice to the

individual has been made that his or her contact information will be

shared with other members of the same operational program in order to

facilitate collaboration.

D. To a Congressional office from the record of an individual in

response to an inquiry from that Congressional office made at the

written or attested to request of the individual to whom the record

pertains.

E. To the National Archives and Records Administration or other

Federal government agencies pursuant to records management inspections

being conducted under the authority of 44 U.S.C. Sections 2904 and

2906.

F. To the Department of Justice (DOJ), or other Federal agency

conducting litigation or in proceedings before any court, adjudicative

or administrative body, when: (a) DHS; (b) any employee of DHS in his/

her official capacity; (c) any employee of DHS in his/her individual

capacity where DOJ or DHS has agreed to represent the employee; or (d)

the United States or any agency thereof, is a party to the litigation

or has an interest in such litigation.

Disclosure to consumer reporting agencies:

None.

[[Page 78448]]

Policies and practices for storing, retrieving, accessing, retaining,

and disposing of records in the system:

Storage

Records in this system are on paper and/or in digital or other

electronic form. Digital and other electronic images are stored on a

storage area network in a secured environment.

Retrievability:

Information may be retrieved by an identification number assigned

by computer, by facility, by business affiliation, e-mails address, or

by the name of the individual.

Safeguards:

Information in this system is safeguarded in accordance with

applicable laws, rules and policies, including the DHS Information

Technology Security Program Handbook. Further, GITAARS security

protocols will meet multiple NIST Security Standards from

Authentication to Certification and Accreditation. Records in the

GITAARS will be maintained in a secure, password protected electronic

system that will utilize security hardware and software to include:

multiple firewalls, active intruder detection, and role-based access

controls. Additional safeguards will vary by component and program. All

records are protected from unauthorized access through appropriate

administrative, physical, and technical safeguards. These safeguards

include: restricting access to authorized personnel who have a ``need

to know;'' using locks; and password protection identification

features. Classified information is appropriately stored in accordance

with applicable requirements. DHS file areas are locked after normal

duty hours and the facilities are protected from the outside by

security personnel.

Retention and disposal:

Records are retained and disposed of in accordance with the

National Archives and Records Administration's General Records Schedule

24, section 6, ``User Identification, Profiles, Authorizations, and

Password Files.'' Inactive records will be destroyed or deleted 6 years

after the user account is terminated or password is altered, or when no

longer needed for investigative or security purposes, whichever is

later.

System manager(s) and address:

For Headquarters components of the Department of Homeland Security,

the System Manager is the Director of Departmental Disclosure, U.S.

Department of Homeland Security, Washington, DC 20528.

For operational components that comprise the U.S. Department of

Homeland Security, the System Managers are as follows:

United States Coast Guard, FOIA Officer/PA System Manager,

Commandant, CG-611, U.S. Coast Guard, 2100 2nd Street, SW., Washington,

DC 20593-0001.

United States Secret Service, FOIA/PA System Manager,

Suite 3000, 950 H Street, NW., Washington, DC 20223.

Under Secretary for Federal Emergency Management

Directorate, FOIA/PA System Manager, 500 C Street, SW., Room 840,

Washington, DC 20472.

Director, Citizenship and Immigration Services, U.S.

Citizenship and Immigration Services, ATTN: Records Services Branch

(FOIA/PA), 111 Massachusetts Ave, NW., 2nd Floor, Washington, DC 20529.

Commissioner, Customs and Border Protection, FOIA/PA

System Manager, Disclosure Law Branch, Office of Regulations & Rulings,

Ronald Reagan Building, 1300 Pennsylvania Avenue, NW., (Mint Annex)

Washington, DC 20229.

Bureau of Immigration and Customs Enforcement, FOIA/PA

System Manager, Office of Investigation, Chester Arthur Building (CAB),

425 I Street, NW., Room 4038, Washington, DC 20538.

Assistant Secretary, Transportation Security

Administration, FOIA/PA System Manager, Office of Security, West

Building, 4th Floor, Room 432-N, TSA-20, 601 South 12th Street,

Arlington, VA 22202-4220.

Federal Protective Service, FOIA/PA System Manager, 1800 F

Street, NW., Suite 2341, Washington, DC 20405.

Federal Law Enforcement Training Center, Disclosure

Officer, 1131 Chapel Crossing Road, Building 94, Glynco, GA 31524.

Under Secretary for Science & Technology, FOIA/PA System

Manager, Washington, DC 20528.

Under Secretary for Preparedness, Nebraska Avenue Complex,

Building 81, 1st floor, Washington, DC 20528.

Director, Operations Coordination, Nebraska Avenue

Complex, Building 3, Washington, DC 20529.

Officer of Intelligence and Analysis, Nebraska Avenue

Complex, Building 19, Washington, DC 20529.

Notification procedure:

To determine whether this system contains records relating to you,

write to the appropriate System Manager(s) identified above.

Record access procedures:

A request for access to records in this system may be made by

writing to the System Manager, identified above, in conformance with 6

CFR Part 5, Subpart B, which provides the rules for requesting access

to Privacy Act records maintained by DHS.

Contesting record procedures:

Same as ``Records Access Procedures'' above.

Record source categories:

Information contained in this system is obtained from affected

individuals/organizations/facilities, public source data, other

government agencies and/or information already in other DHS records

systems.

Exemptions claimed for the system:

None.

Dated: December 18, 2006.

Hugo Teufel III,

Chief Privacy Officer.

[FR Doc. E6-22008 Filed 12-28-06; 8:45 am]

BILLING CODE 4410-10-P