Privacy Act Regulations; Exemption for the Insider Threat Program, 51926-51929 [2014-20743]

Agencies

• DEPARTMENT OF THE INTERIOR

[Federal Register Volume 79, Number 169 (Tuesday, September 2, 2014)]
[Proposed Rules]
[Pages 51926-51929]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2014-20743]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF THE INTERIOR

[XXXD4523WT DWT000000.000000 DS65101000]

43 CFR Part 2

RIN 1090-AB07


Privacy Act Regulations; Exemption for the Insider Threat Program

AGENCY: Department of the Interior.

ACTION: Proposed rule

-----------------------------------------------------------------------

SUMMARY: The Department of the Interior proposes to amend its 
regulations to exempt certain records in the Insider Threat Program 
from one or more provisions of the Privacy Act because of criminal, 
civil, and

[[Page 51927]]

administrative law enforcement requirements.

DATES: Submit written comments on or before November 3, 2014

ADDRESSES: Send written comments, identified by the number 1090-AB07, 
by one of the following methods:
     Federal e-Rulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     Mail: Teri Barnett, Department of the Interior Privacy Act 
Officer, 1849 C Street NW., Mail Stop 5547 MIB, Washington, DC 20240.

FOR FURTHER INFORMATION CONTACT: Teri Barnett, Department of the 
Interior Privacy Act Officer, 1849 C Street NW., Mail Stop 5547 MIB, 
Washington, DC 20240. Email at Privacy@ios.doi.gov.

SUPPLEMENTARY INFORMATION:

Background

    The Privacy Act of 1974, as amended, 5 U.S.C. 552a, governs the 
means by which the U.S. Government collects, maintains, uses and 
disseminates personally identifiable information. The Privacy Act 
applies to records about individuals that are maintained in a ``system 
of records.'' A system of records is a group of any records under the 
control of an agency from which information about an individual is 
retrieved by the name of the individual or by some identifying number, 
symbol, or other identifying particular assigned to the individual. See 
5 U.S.C. 552a(a)(4) and (5).
    An individual may request access to records containing information 
about him or herself, 5 U.S.C. 552a(b), (c) and (d). However, the 
Privacy Act authorizes Federal agencies to exempt systems of records 
from access by individuals under certain circumstances, such as where 
the access or disclosure of such information would impede national 
security or law enforcement efforts. Exemptions from Privacy Act 
provisions must be established by regulation, 5 U.S.C. 552a(j) and (k).
    The Department of the Interior (DOI) Office of Law Enforcement and 
Security created the Insider Threat Program system of records to 
implement Presidential Executive Order 13587, issued October 7, 2011, 
which required Federal agencies to establish an insider threat 
detection and prevention program to ensure the security of classified 
networks and the responsible sharing and safeguarding of classified 
information consistent with appropriate protections for privacy and 
civil liberties. The Insider Threat Program system of records will be 
used to facilitate management of insider threat investigations and 
activities associated with counterintelligence complaints, inquiries 
and investigations; identify potential threats to Department of the 
Interior resources and information assets; track referrals of potential 
insider threats to internal and external partners; and provide 
statistical reports and meet other insider threat reporting 
requirements. Insider threats include attempted or actual espionage, 
subversion, sabotage, terrorism or extremist activities directed 
against the Department of the Interior and its personnel, facilities, 
resources, and activities; unauthorized use of or intrusion into 
automated information systems; unauthorized disclosure of classified, 
controlled unclassified, sensitive, or proprietary-information or 
technology; indicators of potential insider threats or other incidents 
that may indicate activities of an insider threat.
    The Insider Threat Program system contains classified and 
unclassified intelligence and law enforcement investigatory records 
related to counterintelligence and insider threat activities that are 
exempt from certain provisions of the Privacy Act, 5 U.S.C. 552a(j)(2) 
and (k)(2). In this notice of proposed rulemaking, the Department of 
the Interior is proposing to exempt the Insider Threat Program system 
from certain provisions of the Privacy Act pursuant to 5 U.S.C. 
552a(j)(2) and (k)(2).
    Under 5 U.S.C. 552a (j)(2), the head of a Federal agency may 
promulgate rules to exempt a system of records from certain provisions 
of 5 U.S.C. 552a if the system of records is ``maintained by an agency 
or component thereof which performs as its principal function any 
activity pertaining to the enforcement of criminal laws, including 
police efforts to prevent, control or reduce crime or to apprehend 
criminals.'' Under 5 U.S.C. 552a (k)(2), the head of a Federal agency 
may promulgate rules to exempt a system of records from certain 
provisions of 5 U.S.C. 552a if the system of records is ``investigatory 
material complied for law enforcement purposes, other than material 
within the scope of subsection (j)(2),'' or ``investigatory material 
compiled solely for the purpose of determining suitability, 
eligibility, or qualifications for Federal civilian employment, 
military service, Federal contracts, or access to classified 
information.''
    Because this system of records contains investigative and law 
enforcement material within the provisions of 5 U.S.C. 552a(j)(2) and 
(k)(2), the Department of the Interior proposes to exempt the Insider 
Threat Program system of records from one or more of the following 
provisions: 5 U.S.C. 552a(c)(3), (c)(4), (d), (e)(1) through (e)(3), 
(e)(4)(G) through (e)(4)(I), (e)(5), (e)(8), (e)(12), (f), and (g). 
Where a release would not interfere with or adversely affect 
investigations or law enforcement activities, including but not limited 
to revealing sensitive information or compromising confidential 
sources, the exemption may be waived on a case-by-case basis. 
Exemptions from these particular subsections are justified for the 
following reasons:
    1. 5 U.S.C. 552a(c)(3). This section requires an agency to make the 
accounting of each disclosure of records available to the individual 
named in the record upon request. Release of accounting of disclosures 
would alert the subjects of an investigation to the existence of the 
investigation and the fact that they are subjects of the investigation. 
The release of such information to the subjects of an investigation 
would provide them with significant information concerning the nature 
of the investigation, and could seriously impede or compromise the 
investigation, endanger the physical safety of confidential sources, 
witnesses and their families, and lead to the improper influencing of 
witnesses, the destruction of evidence, or the fabrication of 
testimony.
    2. 5 U.S.C. 552a(c)(4); (d); (e)(4)(G) and (e)(4)(H); (f); and (g). 
These sections require an agency to provide notice and disclosure to 
individuals that a system contains records pertaining to the 
individual, as well as providing rights of access and amendment. 
Granting access to records in the Insider Threat Program system could 
inform the subject of an investigation of an actual or potential 
criminal violation of the existence of that investigation, of the 
nature and scope of the information and evidence obtained, of the 
identity of confidential sources, witnesses, and law enforcement 
personnel, and could provide information to enable the subject to avoid 
detection or apprehension. Granting access to such information could 
seriously impede or compromise an investigation; endanger the physical 
safety of confidential sources, witnesses, and law enforcement 
personnel, as well as their families; lead to the improper influencing 
of witnesses, the destruction of evidence, or the fabrication of 
testimony; and disclose investigative techniques and procedures. In 
addition, granting access to such information could disclose 
classified, security-sensitive, or confidential information and could 
constitute an unwarranted invasion of the personal privacy of others.

[[Page 51928]]

    3. 5 U.S.C. 552a(e)(1). This section requires the agency to 
maintain information about an individual only to the extent that such 
information is relevant or necessary. The application of this provision 
could impair investigations and law enforcement, because it is not 
always possible to determine the relevance or necessity of specific 
information in the early stages of an investigation. Relevance and 
necessity are often questions of judgment and timing, and it is only 
after the information is evaluated that the relevance and necessity of 
such information can be established. In addition, during the course of 
the investigation, the investigator may obtain information that is 
incidental to the main purpose of the investigation but which may 
relate to matters under the investigative jurisdiction of another 
agency. Such information cannot readily be segregated. Furthermore, 
during the course of the investigation, an investigator may obtain 
information concerning the violation of laws outside the scope of the 
investigator's jurisdiction. In the interest of effective law 
enforcement, DOI investigators should retain this information, since it 
can aid in establishing patterns of criminal activity and can provide 
valuable leads for other law enforcement agencies.
    4. 5 U.S.C. 552a(e)(2). This section requires the agency to collect 
information directly from the individual to the greatest extent 
practical when the information may result in an adverse determination. 
The application of this provision could impair investigations and law 
enforcement activities by alerting the subject of an investigation of 
the existence of the investigation, enabling the subject to avoid 
detection or apprehension, to influence witnesses improperly, to 
destroy evidence, or to fabricate testimony. In addition, in certain 
circumstances, the subject of an investigation cannot be required to 
provide information to investigators, and information must be collected 
from other sources. Furthermore, it is often necessary to collect 
information from sources other than the subject of the investigation to 
verify the accuracy of the evidence collected.
    5. 5 U.S.C. 552a(e)(3). This section requires an agency to inform 
each person whom it asks to supply information, on a form that can be 
retained by the person, of the authority which the information is 
sought and whether disclosure is mandatory or voluntary; of the 
principal purposes for which the information is intended to be used; of 
the routine uses that may be made of the information; and the effects 
on the person, if any, of not providing all or any part of the 
requested information. The application of this provision could provide 
the subject of an investigation with substantial information about the 
nature of that investigation, which could interfere with the 
investigation. Moreover, providing such information to the subject of 
an investigation could seriously impede or compromise an undercover 
investigation by revealing its existence and could endanger the 
physical safety of confidential sources, witnesses, and investigators 
by revealing their identities.
    6. 5 U.S.C. 552a(e)(4)(I). This section requires an agency to 
provide public notice of the categories of sources of records in the 
system. The application of this section could disclose investigative 
techniques and procedures and cause sources to refrain from giving such 
information because of fear of reprisal, or fear of breach of 
promise(s) of anonymity and confidentiality. This could compromise 
DOI's ability to conduct investigations and to identify, detect and 
apprehend violators.
    7. 5 U.S.C. 552a(e)(5). This section requires an agency to maintain 
its records with such accuracy, relevance, timeliness, and completeness 
as is reasonably necessary to assure fairness to the individual in 
making any determination about the individual. In collecting 
information during investigations and for criminal law enforcement 
purposes, it is not possible to determine in advance what information 
is accurate, relevant, timely, and complete. Material that may seem 
unrelated, irrelevant, or incomplete when collected may take on added 
meaning or significance as the investigation progresses. The 
restrictions of this provision could interfere with the preparation of 
a complete investigative report and impede effective law enforcement.
    8. 5 U.S.C. 552a(e)(8). This section requires an agency to make 
reasonable efforts to serve notice on an individual when any record on 
the individual is made available to any person under compulsory legal 
process when that process becomes a matter of public record. Complying 
with this provision could prematurely reveal an ongoing investigation 
to the subject of the investigation.
    9. 5 U.S.C. 552a(e)(12). This section requires an agency to publish 
in the Federal Register notice of the establishment or revision of a 
matching program at least 30 days prior to conducting the matching 
program. Complying with this provision could prematurely reveal an 
ongoing investigation to the subject of the investigation, impede DOI's 
ability to conduct law enforcement investigative matches, and 
compromise investigations and efforts to identify and detect potential 
insider threats.

Procedural Requirements

1. Regulatory Planning and Review (E.O. 12866)

    Executive Order 12866 provides that the Office of Information and 
Regulatory Affairs in the Office of Management and Budget will review 
all significant rules. The Office of Information and Regulatory Affairs 
has determined that this rule is not significant.
    Executive Order 13563 reaffirms the principles of E.O. 12866 while 
calling for improvements in the nation's regulatory system to promote 
predictability, to reduce uncertainty, and to use the best, most 
innovative, and least burdensome tools for achieving regulatory ends. 
The executive order directs agencies to consider regulatory approaches 
that reduce burdens and maintain flexibility and freedom of choice for 
the public where these approaches are relevant, feasible, and 
consistent with regulatory objectives. E.O. 13563 emphasizes further 
that regulations must be based on the best available science and that 
the rulemaking process must allow for public participation and an open 
exchange of ideas. We have developed this rule in a manner consistent 
with these requirements.

2. Regulatory Flexibility Act

    The Department of the Interior certifies that this document will 
not have a significant economic effect on a substantial number of small 
entities under the Regulatory Flexibility Act (5 U.S.C. 601, et seq.). 
This rule does not impose a requirement for small businesses to report 
or keep records on any of the requirements contained in this rule. The 
exemptions to the Privacy Act apply to individuals, and individuals are 
not covered entities under the Regulatory Flexibility Act.

3. Small Business Regulatory Enforcement Fairness Act (SBREFA)

    This rule is not a major rule under 5 U.S.C. 804(2), the Small 
Business Regulatory Enforcement Fairness Act. This rule:
    (a) Does not have an annual effect on the economy of $100 million 
or more.
    (b) Will not cause a major increase in costs or prices for 
consumers, individual industries, Federal, State, or local government 
agencies, or geographic regions.

[[Page 51929]]

    (c) Does not have significant adverse effects on competition, 
employment, investment, productivity, innovation, or the ability of 
United States-based enterprises to compete with foreign-based 
enterprises.

4. Unfunded Mandates Reform Act

    This rule does not impose an unfunded mandate on State, local, or 
tribal governments in the aggregate, or on the private sector, of more 
than $100 million per year. The rule does not have a significant or 
unique effect on State, local, or tribal governments or the private 
sector. This rule makes only minor changes to 43 CFR part 2. A 
statement containing the information required by the Unfunded Mandates 
Reform Act (2 U.S.C. 1531 et seq.) is not required.

5. Takings (E.O. 12630)

    In accordance with Executive Order 12630, the rule does not have 
significant takings implications. This rule makes only minor changes to 
43 CFR part 2. A takings implication assessment is not required.

6. Federalism (E.O. 13132)

    In accordance with Executive Order 13132, this rule does not have 
any federalism implications to warrant the preparation of a Federalism 
Assessment. The rule is not associated with, nor will it have 
substantial direct effects on the States, on the relationship between 
the national government and the States, or on the distribution of power 
and responsibilities among the various levels of government. A 
Federalism Assessment is not required.

 7. Civil Justice Reform (E.O. 12988)

    This rule complies with the requirements of Executive Order 12988. 
Specifically, this rule:
    (a) Does not unduly burden the judicial system.
    (b) Meets the criteria of section 3(a) requiring that all 
regulations be reviewed to eliminate errors and ambiguity and be 
written to minimize litigation; and
    (c) Meets the criteria of section 3(b)(2) requiring that all 
regulations be written in clear language and contain clear legal 
standards.

8. Consultation with Indian Tribes (E.O. 13175)

    In accordance with Executive Order 13175, the Department of the 
Interior has evaluated this rule and determined that it would have no 
substantial effects on federally recognized Indian Tribes.

9. Paperwork Reduction Act

    This rule does not require an information collection from 10 or 
more parties and a submission under the Paperwork Reduction Act is not 
required.

10. National Environmental Policy Act

    This rule does not constitute a major Federal action and would not 
have a significant effect on the quality of the human environment. 
Therefore, this rule does not require the preparation of an 
environmental assessment or environmental impact statement under the 
requirements of the National Environmental Policy Act of 1969.

11. Effects on Energy Supply (E.O. 13211)

    This rule is not a significant energy action under the definition 
in Executive Order 13211. A Statement of Energy Effects is not 
required.

12. Clarity of this Regulation

    We are required by Executive Order 12866 and 12988, the Plain 
Writing Act of 2010 (H.R. 946), and the Presidential Memorandum of June 
1, 1998, to write all rules in plain language. This means each rule we 
publish must:

--Be logically organized;
--Use the active voice to address readers directly;
--Use clear language rather than jargon;
--Be divided into short sections and sentences; and
--Use lists and table wherever possible.

 List of Subjects in 43 CFR Part 2

    Administrative practice and procedure, Confidential information, 
Courts, Freedom of Information Act, Privacy Act.

    Dated: August 21, 2014.
Rhea Suh,
Assistant Secretary for Policy, Management and Budget.

    For the reasons stated in the preamble, the Department of the 
Interior proposes to amend 43 CFR part 2 as follows:

PART 2--FREEDOM OF INFORMATION ACT; RECORDS AND TESTIMONY

0
1. The authority citation for part 2 continues to read as follows:

    Authority: 5 U.S.C. 301, 552, 552a, 553; 31 U.S.C. 3717; 43 
U.S.C. 1460, 1461.

0
2. Amend Sec.  2.254 by:
0
a. Revising the introductory text in paragraph (a);
0
b. Reserving paragraph (a)(5) and adding paragraph (a)(6);
0
c. Revising the introductory text in paragraph (b); and
0
d. Reserving paragraphs (b)(14) and (b)(15) and adding paragraph 
(b)(16).
    The revisions and additions read as follows:


Sec.  2.254--Exemptions.  

    (a) Criminal law enforcement records exempt under 5 U.S.C. 
552a(j)(2). Pursuant to 5 U.S.C. 552a(j)(2) the following systems of 
records are exempted from all of the provisions of 5 U.S.C. 552a and 
the regulations in this subpart except paragraphs (b), (c) (1) and (2), 
(e)(4) (A) through (F), (e) (6), (7), (9), (10), (11) and (12), and (i) 
of 5 U.S.C. 552a and the portions of the regulations in this subpart 
implementing these paragraphs:
* * * * *
    (5) [Reserved]
    (6) Insider Threat Program, DOI-50.
    (b) Law enforcement records exempt under 5 U.S.C. 552a(k)(2). 
Pursuant to 5 U.S.C. 552a(k)(2), the following systems of records are 
exempted from paragraphs (c)(3), (d), (e)(1), (e)(4) (G), (H), and (I), 
and (f) of 5 U.S.C. 552a and the provisions of the regulations in this 
subpart implementing these paragraphs:
* * * * *
    (14) [Reserved]
    (15) [Reserved]
    (16) Insider Threat Program, DOI-50.

[FR Doc. 2014-20743 Filed 8-29-14; 8:45 am]
BILLING CODE 4310-RK-P