Privacy Act of 1974; System of Records, 78446-78448 [E6-22008]

Agencies

• Office of the Secretary
• DEPARTMENT OF HOMELAND SECURITY

[Federal Register Volume 71, Number 250 (Friday, December 29, 2006)]
[Notices]
[Pages 78446-78448]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E6-22008]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Office of the Secretary

[Docket No. DHS-2006-0076]


Privacy Act of 1974; System of Records

AGENCY: Privacy Office, DHS.

ACTION: Notice of Privacy Act System of Records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Department of 
Homeland Security is giving notice that it proposes to add a new system 
of records to its inventory of record systems for Department of 
Homeland Security General Information Technology Access Account Records 
System.

DATES: Written comments must be submitted on or before January 29, 
2007.

ADDRESSES: You may submit comments, identified by Docket Number DHS-
2006-0076 by one of the following methods:
     Federal e-Rulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     Fax: 202-572-8727 (not a toll-free number).
     Mail: Hugo Teufel III, Chief Privacy Officer, Privacy 
Office, Department of Homeland Security, Washington, DC 20528.

FOR FURTHER INFORMATION CONTACT: Please identify by Docket Number DHS-
2006-0076 to request further information by one of the following 
methods:
     Mail: Hugo Teufel III, Chief Privacy Officer, Privacy 
Office, Department of Homeland Security, Washington, DC 20528.

[[Page 78447]]

     Facsimile: 202-572-8727 (not a toll-free number).
     E-Mail: privacy@dhs.gov.

SUPPLEMENTARY INFORMATION: As part of its efforts to streamline and 
consolidate its record system, the Department of Homeland Security 
(DHS) is establishing a new agency-wide systems of records under the 
Privacy Act of 1974 (5 U.S.C. 552a) for the Department of Homeland 
Security General Information Technology Access Account Records System 
(GITAARS). This system of records is part of DHS's ongoing record 
integration and management efforts. This system will consist of 
information collected in order to provide authorized individuals with 
access to DHS information technology resources. This information 
includes user name, business affiliation, account information and 
passwords.
    The Privacy Act embodies fair information principles in a statutory 
framework governing the means by which the U.S. Government collects, 
maintains, uses and disseminates personally identifiable information. 
The Act applies to information that is maintained in a ``system of 
records.'' A ``system of records'' is a group of any records under the 
control of an agency from which information is retrieved by the name of 
an individual or by some identifying number, symbol, or other 
identifying particular assigned to the individual. The Privacy Act 
requires each agency to publish in the Federal Register a description 
of the type and character of each system of records that the agency 
maintains, and the routine uses for which such information may be 
disseminated and the purpose for which the system is maintained. 
Individuals may request their own records that are maintained in a 
system of records in the possession or under the control of DHS by 
complying with DHS Privacy Act regulations, 6 CFR Part 5.
    In accordance with 5 U.S.C. 552a(r), a report on this system has 
been sent to Congress and to the Office of Management and Budget.
DHS-2006-0076

System name:
    General Information Technology Access Account Records System, DHS/
ALL 004.

Security classification:
    Unclassified but sensitive.

System location:
    Records are maintained by the Department of Homeland Security at 
the DHS Data Center in Washington, DC, and at a limited number of 
remote locations where DHS components or program maintain secure 
facilities and conducts its mission.

Categories of individuals covered by the system:
    A. All persons who are authorized to access DHS Information 
Technology resources, including employees, contractors, grantees, 
private enterprises and any lawfully designated representative of the 
above and including representatives of Federal, state, territorial, 
tribal, local, international, or foreign government agencies or 
entities, in furtherance of the DHS mission;
    B. Individuals who serve on DHS boards and committees;
    C. Individuals who have business with DHS and who have provided 
personal information in order to facilitate access to DHS Information 
Technology resources; and
    D. Individuals who are facility points of contact for government 
business and the individual(s) they list as emergency contacts.

Categories of records in the system:
    DHS/ALL 004 contains names, business affiliations, facility 
positions held, business telephone numbers, cellular phone numbers, 
pager numbers, numbers where individuals can be reached while on travel 
or otherwise away from the office, citizenship, home addresses, 
electronic mail addresses, names and phone numbers of other contacts, 
the positions or titles of those contacts, their business affiliations 
and other contact information provided to the Department that is 
derived from other sources to facilitate authorized access to DHS 
Information Technology resources.

Authority for maintenance of the system:
    5 U.S.C. 301; 44 U.S.C. 3101.

Purpose(s):
    This system will collect a discreet set of personal information in 
order to provide authorized individuals access to DHS information 
technology resources. The information collected by the system will 
include full name, user name, account information, citizenship, 
business affiliation, contact information, and passwords.
    The system enables DHS to maintain: (a) Account information for 
gaining access to information technology; (b) lists of individuals who 
are appropriate organizational points of contact for the Department; 
and (c) lists of individuals who are emergency points of contact. The 
system will also enable DHS to provide individuals access to certain 
programs and meeting attendance and where appropriate allow for sharing 
of information between individuals in the same operational program to 
facilitate collaboration.

Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) of the Privacy Act, all or a portion of the records or 
information contained in this system may be disclosed outside DHS as a 
routine use pursuant to 5 U.S.C. 552a(b)(3), limited by privacy impact 
assessments, data sharing, or other agreements, as follows:
    A. To DHS contractors, consultants or others, when necessary to 
perform a function or service related to this system of records for 
which they have been engaged. Such recipients are required to comply 
with the Privacy Act of 1974, as amended (5 U.S.C. 552a).
    B. To sponsors, employers, contractors, facility operators, 
grantees, experts, and consultants in connection with establishing an 
access account for an individual and when necessary to accomplish a DHS 
mission function related to this system of records.
    C. To other individuals in the same operational program supported 
by an information technology system, where appropriate notice to the 
individual has been made that his or her contact information will be 
shared with other members of the same operational program in order to 
facilitate collaboration.
    D. To a Congressional office from the record of an individual in 
response to an inquiry from that Congressional office made at the 
written or attested to request of the individual to whom the record 
pertains.
    E. To the National Archives and Records Administration or other 
Federal government agencies pursuant to records management inspections 
being conducted under the authority of 44 U.S.C. Sections 2904 and 
2906.
    F. To the Department of Justice (DOJ), or other Federal agency 
conducting litigation or in proceedings before any court, adjudicative 
or administrative body, when: (a) DHS; (b) any employee of DHS in his/
her official capacity; (c) any employee of DHS in his/her individual 
capacity where DOJ or DHS has agreed to represent the employee; or (d) 
the United States or any agency thereof, is a party to the litigation 
or has an interest in such litigation.

Disclosure to consumer reporting agencies:
    None.

[[Page 78448]]

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage
    Records in this system are on paper and/or in digital or other 
electronic form. Digital and other electronic images are stored on a 
storage area network in a secured environment.

Retrievability:
    Information may be retrieved by an identification number assigned 
by computer, by facility, by business affiliation, e-mails address, or 
by the name of the individual.

Safeguards:
    Information in this system is safeguarded in accordance with 
applicable laws, rules and policies, including the DHS Information 
Technology Security Program Handbook. Further, GITAARS security 
protocols will meet multiple NIST Security Standards from 
Authentication to Certification and Accreditation. Records in the 
GITAARS will be maintained in a secure, password protected electronic 
system that will utilize security hardware and software to include: 
multiple firewalls, active intruder detection, and role-based access 
controls. Additional safeguards will vary by component and program. All 
records are protected from unauthorized access through appropriate 
administrative, physical, and technical safeguards. These safeguards 
include: restricting access to authorized personnel who have a ``need 
to know;'' using locks; and password protection identification 
features. Classified information is appropriately stored in accordance 
with applicable requirements. DHS file areas are locked after normal 
duty hours and the facilities are protected from the outside by 
security personnel.

Retention and disposal:
    Records are retained and disposed of in accordance with the 
National Archives and Records Administration's General Records Schedule 
24, section 6, ``User Identification, Profiles, Authorizations, and 
Password Files.'' Inactive records will be destroyed or deleted 6 years 
after the user account is terminated or password is altered, or when no 
longer needed for investigative or security purposes, whichever is 
later.

System manager(s) and address:
    For Headquarters components of the Department of Homeland Security, 
the System Manager is the Director of Departmental Disclosure, U.S. 
Department of Homeland Security, Washington, DC 20528.
    For operational components that comprise the U.S. Department of 
Homeland Security, the System Managers are as follows:
     United States Coast Guard, FOIA Officer/PA System Manager, 
Commandant, CG-611, U.S. Coast Guard, 2100 2nd Street, SW., Washington, 
DC 20593-0001.
     United States Secret Service, FOIA/PA System Manager, 
Suite 3000, 950 H Street, NW., Washington, DC 20223.
     Under Secretary for Federal Emergency Management 
Directorate, FOIA/PA System Manager, 500 C Street, SW., Room 840, 
Washington, DC 20472.
     Director, Citizenship and Immigration Services, U.S. 
Citizenship and Immigration Services, ATTN: Records Services Branch 
(FOIA/PA), 111 Massachusetts Ave, NW., 2nd Floor, Washington, DC 20529.
     Commissioner, Customs and Border Protection, FOIA/PA 
System Manager, Disclosure Law Branch, Office of Regulations & Rulings, 
Ronald Reagan Building, 1300 Pennsylvania Avenue, NW., (Mint Annex) 
Washington, DC 20229.
     Bureau of Immigration and Customs Enforcement, FOIA/PA 
System Manager, Office of Investigation, Chester Arthur Building (CAB), 
425 I Street, NW., Room 4038, Washington, DC 20538.
     Assistant Secretary, Transportation Security 
Administration, FOIA/PA System Manager, Office of Security, West 
Building, 4th Floor, Room 432-N, TSA-20, 601 South 12th Street, 
Arlington, VA 22202-4220.
     Federal Protective Service, FOIA/PA System Manager, 1800 F 
Street, NW., Suite 2341, Washington, DC 20405.
     Federal Law Enforcement Training Center, Disclosure 
Officer, 1131 Chapel Crossing Road, Building 94, Glynco, GA 31524.
     Under Secretary for Science & Technology, FOIA/PA System 
Manager, Washington, DC 20528.
     Under Secretary for Preparedness, Nebraska Avenue Complex, 
Building 81, 1st floor, Washington, DC 20528.
     Director, Operations Coordination, Nebraska Avenue 
Complex, Building 3, Washington, DC 20529.
     Officer of Intelligence and Analysis, Nebraska Avenue 
Complex, Building 19, Washington, DC 20529.

Notification procedure:
    To determine whether this system contains records relating to you, 
write to the appropriate System Manager(s) identified above.

Record access procedures:
    A request for access to records in this system may be made by 
writing to the System Manager, identified above, in conformance with 6 
CFR Part 5, Subpart B, which provides the rules for requesting access 
to Privacy Act records maintained by DHS.

Contesting record procedures:
    Same as ``Records Access Procedures'' above.

Record source categories:
    Information contained in this system is obtained from affected 
individuals/organizations/facilities, public source data, other 
government agencies and/or information already in other DHS records 
systems.

Exemptions claimed for the system:
    None.

    Dated: December 18, 2006.
Hugo Teufel III,
Chief Privacy Officer.
[FR Doc. E6-22008 Filed 12-28-06; 8:45 am]
BILLING CODE 4410-10-P