Privacy Act of 1974; Revised System of Records, 8503-8506 [2017-01767]

Download as PDF 8503 Notices Federal Register Vol. 82, No. 16 Thursday, January 26, 2017 This section of the FEDERAL REGISTER contains documents other than rules or proposed rules that are applicable to the public. Notices of hearings and investigations, committee meetings, agency decisions and rulings, delegations of authority, filing of petitions and applications and agency statements of organization and functions are examples of documents appearing in this section. DEPARTMENT OF AGRICULTURE Office of the Secretary Privacy Act of 1974; Revised System of Records Office of the Chief Information Officer, USDA. ACTION: Notice of the revision of Privacy Act system of records. AGENCY: In accordance with the Privacy Act of 1974, the Department of Agriculture proposes to revise an existing Department of Agriculture system of records notice now titled, USDA/OCIO–2 eAuthentication Service (eAuth). The USDA eAuth provides the public and government businesses with a single sign-on capability for USDA applications, management of user credentials, and verification of identity, authorization, and electronic signatures. USDA’s eAuth collects customer information through an electronic selfregistration process provided through the eAuth Web site. This System of Records Notice was previously published as ‘‘USDA eAuthentication Service’’ in Federal Register Vol. 77, No. 50 on Wednesday, March 14, 2012. The revision reflects updates to the system name; the system location; routine uses; storage policies; safeguards; retention and disposal; identity proofing individuals, the system manager; and notification, record access, and contesting procedures. SUMMARY: Submit comments on or before March 7, 2017. This new system will be effective March 7, 2017. ADDRESSES: You may submit comments, identified by docket number USDA/ OCIO–2 by one of the following methods: • Federal e-Rulemaking Portal: http:// www.regulations.gov. Follow the instructions for submitting comments. • Fax: (970) 295–5238. jstallworth on DSK7TPTVN1PROD with NOTICES DATES: VerDate Sep<11>2014 15:10 Jan 25, 2017 Jkt 241001 • Mail: Adam Zeimet, Branch Chief, Identity Access Branch, eAuthentication, 2150 Centre Avenue, Building A, Suite 350, Fort Collins, Colorado 80526. • Instructions: All submissions received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to http:// www.regulations.gov, including any personal information provided. • Docket: For access to the docket to read background documents or comments received, go to http:// www.regulations.gov. FOR FURTHER INFORMATION CONTACT: For general questions, please contact: Adam Zeimet, Program Manager, (970) 295– 5678, 2150 Centre Avenue, Building A, Suite 350, Fort Collins, Colorado 80526. For privacy issues, please contact: Kelvin Fairfax, Chief Privacy Officer, Technology Planning, Architecture and E-Government, Office of the Chief Information Officer, Department of Agriculture, Washington, DC 20250. SUPPLEMENTARY INFORMATION: I. Background The USDA eAuthentication Service provides USDA Agency customers and employee’s single sign-on capability and electronic authentication and authorization for USDA Web applications and services. Through an online self-registration process, USDA Agency customers and employees can obtain accounts as authorized users that will provide access to USDA resources without needing to re-authenticate within the context of a single Internet session. Once an account is activated, users may use the associated user ID and password that they created to access USDA resources that are protected by eAuthentication. Information stored in the eAuthentication Service may be shared with other USDA components, as well as appropriate Federal, State, local, tribal, foreign, or international government agencies as outlined in the routine uses or authorized by statute. This sharing will take place only after USDA determines that the receiving component or agency has a need to know the information to carry out agency mission, national security, law enforcement, immigration, intelligence, or other functions consistent with the routine uses set forth in this system of records notice. The revisions to this PO 00000 Frm 00001 Fmt 4703 Sfmt 4703 system of records include: Updating the system location, storage policies, storage safeguards, retention and disposal policies; the system manager’s location; the practice of identity proofing individuals; record retrieval; and the notification, record access, & contesting procedures in order to be consistent with the Department’s best practices. In addition, the routine uses were amended as follows: • Routine Use 1. is modified adding account management and user profile management • Routine Use 8. is added to permit another federal agency or federal entity to investigate breaches and remedy risk to individuals • Routine Use 9. is added for disclosure to credit bureaus to conduct identity proofing • Routine Use 10. is added for disclosure for contractors to assist in administering the program • Routine Use 11. Is added for disclosure of records to other federal agencies Dated: January 18, 2017. Michael T. Scuse, Acting Secretary of Agriculture. SYSTEM OF RECORDS USDA/OCIO–2 SYSTEM NAME: USDA/OCIO–2 eAuthentication Service SECURITY CLASSIFICATION: Unclassified. SYSTEM LOCATION: USDA—National Information Technology Center (NITC), 8930 Ward Pkwy, Kansas City, MO 64114. USDA—St. Louis Enterprise Data Center, 4300 Goodfellow Boulevard, St. Louis, MO 63120 US. CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: This system contains records on individuals who applied for and were granted access to USDA applications and services that are protected by eAuthentication. This includes but not limited to public citizens, federal employees, contractor employees, affiliates, etc. CATEGORIES OF RECORDS IN THE SYSTEM: The eAuthentication system will collect the information including but E:\FR\FM\26JAN1.SGM 26JAN1 8504 Federal Register / Vol. 82, No. 16 / Thursday, January 26, 2017 / Notices not limited to name, address, country of residence, telephone, email address, date of birth, user name, password, SSN (Capture Temporarily), challenge question, and challenge answer. The latter two types of information are used to validate a customer’s identity for password reset. The system will request social security number for online identity proofing services through a verification process implemented with a credit bureau. AUTHORITY FOR MAINTENANCE ON THE SYSTEM: Government Paperwork Elimination Act (GPEA, Pub. L. 105–277) of 1998; Freedom to E-File Act (Pub. L. 106–222) of 2000; Electronic Signatures in Global and National Commerce Act (E–SIGN, Pub. L. 106–229) of 2000; eGovernment Act of 2002 (H.R. 2458/Pub. L. 107– 347); GRAMM-LEACH-BLILEY ACT (Pub L. 106–102). PURPOSE(S): The records in this system are used to electronically authenticate and authorize users accessing protected USDA applications and services. eAuthentication shares the user information with authorized federal agencies or contractor systems supporting a federal agency mission for centralized account management and user profile management for USDA. jstallworth on DSK7TPTVN1PROD with NOTICES ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES. RECORDS IN THIS SYSTEM MAY BE DISCLOSED AS FOLLOWS: 1. To external Web applications or information technology systems integrated with the government’s federated architecture for authentication, identity management, and user profile management for USDA. Prior to any disclosure of information under this architecture, the user will request access to an external application with their USDA credential. All external applications will have undergone rigorous testing before joining the architecture. The eAuthentication Service acts as a single sign-on point for USDA Agency applications, allowing a USDA customer to sign onto any USDA applications for which they have been authorized. 2. When a record on its face, or in conjunction with other records, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program, statute, or by regulation, rule, or order issued pursuant thereto, disclosure may be made to the appropriate agency, whether Federal, foreign, State, local, tribal, or other public authority responsible for VerDate Sep<11>2014 15:10 Jan 25, 2017 Jkt 241001 enforcing, investigating, or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to any enforcement, regulatory, investigative, or prosecutive responsibility of the receiving entity. Referral to the appropriate agency, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting violation of law, or of enforcing or implementing a statute, rule, regulation, or order issued pursuant thereto, of any record within this system when information available indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature. 3. To a court or adjudicative body in a proceeding when: (a) USDA or any component thereof; or (b) any employee of USDA in his or her official capacity; or (c) any employee of USDA in his or her individual capacity where USDA has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, USDA determines that the records are both relevant and necessary to the litigation and the use of such records is therefore deemed by USDA to be for a purpose that is compatible with the purpose for which USDA collected the records. 4. To a congressional office in response to an inquiry made at the written request of the individual to whom the record pertains. 5. Disclosure at the individuals’ request to any Federal department, State, local agencies, or USDA partners including but not limited to contractor systems supporting the government mission utilizing or interfacing with eAuthentication to provide electronic authentication. The disclosure of this information is required to securely provide, monitor, and analyze the requested program, service, registration, or other transaction. 6. To the Department of Justice when: (a) USDA or any component thereof; or (b) any employee of USDA in his or her official capacity where the Department of Justice has agreed to represent the employee; or (d) the United States Government, is a party to litigation or has an interest in such litigation, and by careful review, USDA determines that the records are both relevant and necessary to the litigation and the use of such records by the Department of Justice is therefore deemed by USDA to be for a purpose that is compatible with the purpose for which USDA collected the records. PO 00000 Frm 00002 Fmt 4703 Sfmt 4703 7. To appropriate agencies, entities, and persons when (1) USDA suspects or has confirmed that the security or confidentiality of information in the system of records has been compromised; (2) USDA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, USDA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with USDA’s efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. 8. To another Federal agency or Federal entity, when information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the agency (including its information systems, programs and operations), the Federal Government, or national security. 9. Disclosure to credit bureaus to conduct online identity proofing of users including but not limited to public citizens, federal employees, contractor employees, affiliates, etc., for the purpose of remotely verifying the users identity in using eAuthentication account management practices (e.g. Issuing an account & credential, and account recovery). 10. Contract Disclosure. If the Department contracts with an entity for the purpose of performing any function that requires disclosure of records including but not limited to helpdesk operations, password resets, system administration, application operations, program support. The Department may disclose the records as a routine use to those contract employees. Before entering into such a contract, the Department shall require the contractor to maintain Privacy Act safeguards as required under 5 U.S.C. 552a(m) with respect to the records in the system. 11. Disclosure may be made to a private contractor or Federal agency for the purpose of collating, analyzing, aggregating or otherwise refining records for official business in this system. The contractor or Federal agency will be required to maintain Privacy Act safeguards with respect to these records. E:\FR\FM\26JAN1.SGM 26JAN1 Federal Register / Vol. 82, No. 16 / Thursday, January 26, 2017 / Notices POLICIES/PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM: STORAGE: Records are stored and maintained electronically on USDA owned and operated systems in Kansas City, MO and St. Louis, Missouri. Records can be retrieved by a search of user profile attributes including but not limited to Personal Identity Verification (HSPD–12 PID) card identifiers, UserName (Login ID), Last Name, First Name, Email, system ID (eAuth Internal ID), challenge question, and challenge answer. The latter two types of information are used to validate a customer’s identity for helpdesk services only those individuals with approved access rights have this authority and data accessibility. USDA staff and contractors (acting as authorized agents) access information that is necessary to fulfill customer requests, provide end-user technical support and to operate and administer the system. SAFEGUARDS: Records are accessible only to authorized personnel. Protection of the records is ensured by appropriate technical controls. The physical security of the system is provided by restricted building access. In addition, increased security is provided by encryption of data when transmitted. SSN is masked during the capture process when a user enters on the web form. The system has undergone an Assessment and Authorization (A&A) by the OCIO Designated Approving Authority via Agricultural Security Operations Center (ASOC). jstallworth on DSK7TPTVN1PROD with NOTICES RETENTION AND DISPOSAL: Records in this system will be retained in accordance with approved retention schedules, including: (31) General Retention Schedule (DAA– GRS–2013–0006–0004), which provides for annual cut-off and for destruction 6 years after cutoff or longer if required for business use; (61) General Retention Schedule (N1–GRS–07–3, item 13a2), which provides for annual cut-off and for destruction 7 years and 6 months to 20 years to 6 months after cut-off; and additional approved schedules may apply. Destruction of records shall occur in the manner(s) appropriate to the type of record, such as but not limited to shredding of paper records and/or deletion of computer records in accordance with federal requirements. VerDate Sep<11>2014 15:10 Jan 25, 2017 Jkt 241001 SYSTEM MANAGER AND ADDRESS: CONTESTING RECORD PROCEDURES: Program Manager—Identity and Access Management, 2150 Centre Avenue, Fort Collins, CO 80526 Any individual may contest information contained within a record in the system that pertains to him/her by submitting a written request to the system manager at the address above. Include the reason for contesting the record and the proposed amendment to the information with supporting documentation to show how the record is inaccurate. NOTIFICATION PROCEDURE: RETRIEVABILITY: 8505 Individuals seeking notification of and access to any record contained in this system of records, or seeking to contest its content, may submit a request in writing to the Headquarters or component’s FOIA Officer, whose contact information can be found at http://www.da.usda.gov/foia.htm under ‘‘contacts.’’ If an individual believes more than one component maintains Privacy Act records concerning him or her the individual may submit the request to the Chief FOIA Officer, Department of Agriculture, 1400 Independence Avenue SW., Washington, DC 20250. When seeking records about yourself from this system of records or any other Departmental system of records your request must conform with the Privacy Act regulations set forth in 6 CFR part 5. You must first verify your identity, meaning that you must provide your full name, current address and date and place of birth. You must sign your request, and your signature must either be notarized or submitted under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. While no specific form is required, you may obtain forms for this purpose from the Chief FOIA Officer, Department of Agriculture, 1400 Independence Avenue SW., Washington, DC 20250. In addition you should provide the following: • An explanation of why you believe the Department would have information on you, • Identify which component(s) of the Department you believe may have the information about you, • Specify when you believe the records would have been created, • Provide any other information that will help the FOIA staff determine which USDA component agency may have responsive records, • If your request is seeking records pertaining to another living individual, you must include a statement from that individual certifying his/her agreement for you to access his/her records. Without this bulleted information the component(s) may not be able to conduct an effective search, and your request may be denied due to lack of specificity or lack of compliance with applicable regulations. RECORD ACCESS PROCEDURES: See ‘‘Notification procedure’’ above. PO 00000 Frm 00003 Fmt 4703 Sfmt 4703 RECORD SOURCE CATEGORIES: Information maintained in the system will be submitted but not limited to public citizens, federal employees, contractor employees, affiliates, etc.. When a user wishes to transact with USDA or its partner organizations electronically, the user must enter name, address, country of residence, telephone, date of birth, username, and password. To elevate the user to conduct official business with USDA the user must be identity proofed requiring social security number being queried through a national credit bureau. As the USDA eAuthentication Service is integrated with other government or private sector authentication systems, data may be obtained from those systems to facilitate single-sign on capabilities with the user’s permission. EXEMPTIONS CLAIMED FOR THIS SYSTEM: None. U.S. Department of Agriculture Narrative Statement on Revised eAuthentication System of Records Under the Privacy Act of 1974 USDA/OCIO–2 eAuthentication Service The U.S. Department of Agriculture (USDA) eAuthentication Service provides USDA Agency customers and employees single sign-on capability and electronic authentication and authorization for USDA Web applications and services. Through an online self-registration process, USDA Agency customers and employees can obtain accounts as authorized users that will provide access to USDA resources without needing to re-authenticate within the context of a single Internet session. Once an account is activated, users may use the associated user ID and password that they created to access USDA resources that are protected by eAuthentication. Information stored in the eAuthentication Service may be shared with other USDA components, as well as appropriate Federal, State, local, tribal, foreign, or international government agencies as outlined in the routine uses or authorized by statute. This sharing will take place only after USDA determines that the receiving E:\FR\FM\26JAN1.SGM 26JAN1 jstallworth on DSK7TPTVN1PROD with NOTICES 8506 Federal Register / Vol. 82, No. 16 / Thursday, January 26, 2017 / Notices component or agency has a need to know the information to carry out national security, law enforcement, immigration, intelligence, or other functions consistent with the routine uses set forth in this system of records notice. USDA is publishing the routine uses pursuant to which it may disclose information about individuals to the extent the disclosure is consistent with the purpose for which the information was collected. Routine uses include disclosure to external Web applications upon user request, to other government agencies for law enforcement purposes if the record on its face or in conjunction with other records indicates a violation of law, to a court or adjudicative body if relevant and necessary to appropriate litigation, to a congressional office upon written request of the individual, to other government entities of USDA partners upon user request, to USDA contractors or industry to identify fraud, waste, or abuse to the Department of Justice if relevant and necessary for appropriate litigation, or to agencies, entities, or persons to prevent or remedy security breach. The authority for maintaining this system is derived from: Government Paperwork Elimination Act (GPEA, Pub. L. 105–277) of 1998; Freedom to E-File Act (Pub. L. 106–222) of 2000; Electronic Signatures in Global and National Commerce Act (E–SIGN, Pub. L. 106–229) of 2000; eGovernment Act of 2002 (H.R. 2458). Probable or potential effects on the privacy of individuals: Although there is some risk to the privacy of individuals, that risk is outweighed by the benefits to those individuals who will be able to access multiple programs and applications with a single login. In addition, the safeguards in place will protect against unauthorized disclosure. Records are accessible only to individuals who are authorized, and physical and electronic safeguards are employed to ensure security. eAuthentication has a current Authority to Operate obtained via the completion Certification and Accreditation based on the Risk Management Framework. A satisfactory risk assessment has been performed. OMB information collection requirements: OMB information collection approval: OMB No. 0503–0014 [FR Doc. 2017–01767 Filed 1–25–17; 8:45 am] BILLING CODE 3410–ZV–P VerDate Sep<11>2014 15:10 Jan 25, 2017 Jkt 241001 DEPARTMENT OF COMMERCE Foreign-Trade Zones Board [B–007–2017] Foreign-Trade Zone (FTZ) 29— Shelbyville, Kentucky, Notification of Proposed Production Activity, Amcor Flexibles L.L.C., (Flexible Packaging Production, Warehousing, and Distribution), Shelbyville, Kentucky The Louisville and Jefferson County Riverport Authority, grantee of FTZ 29, submitted a notification of proposed production activity to the FTZ Board on behalf of Amcor Flexibles L.L.C. (Amcor), located in Shelbyville, Kentucky. The notification conforming to the requirements of the regulations of the FTZ Board (15 CFR 400.22) was received on January 11, 2017. A separate application for subzone designation at the Amcor facility was submitted and will be processed under Section 400.31 of the Board’s regulations. The facility will be used to produce, warehouse, and distribute flexible packaging used in pharma, food, home, and personal care products. Pursuant to 15 CFR 400.14(b), FTZ activity would be limited to the specific foreign-status materials and components and specific finished products described in the submitted notification (as described below) and subsequently authorized by the FTZ Board. Production under FTZ procedures could exempt Amcor from customs duty payments on the foreign-status components used in export production. On its domestic sales, Amcor would be able to choose the duty rates during customs entry procedures that apply to: Printed and non-printed, non-laminated aluminum foil packaging (duty rate 3.0%); printed, laminated aluminum foil packaging (duty rate 3.7%); nonprinted aluminum foil laminated packaging (duty rate 0.0%); aluminum/ plastic packaging (duty rate 4.2%); aluminum/plastic pouches (duty rate 4.2%); aluminum/plastic tear strip (duty rate 4.2%); and, aluminum foil (not laminated) (duty rate 3.0%) for the foreign-status inputs noted below. Customs duties also could possibly be deferred or reduced on foreign-status production equipment. The components and materials sourced from abroad include polyvinyl chloride film, nylon film, aluminum foil, aluminum/plastic tear strip, and aluminum foil (not laminated) (duty rate ranges from 3.0% to 5.8%). Public comment is invited from interested parties. Submissions shall be addressed to the Board’s Executive Secretary at the address below. The PO 00000 Frm 00004 Fmt 4703 Sfmt 4703 closing period for their receipt is March 7, 2017. A copy of the notification will be available for public inspection at the Office of the Executive Secretary, Foreign-Trade Zones Board, Room 21013, U.S. Department of Commerce, 1401 Constitution Avenue NW., Washington, DC 20230–0002, and in the ‘‘Reading Room’’ section of the Board’s Web site, which is accessible via www.trade.gov/ftz. For further information, contact Juanita H. Chen at Juanita.Chen@ trade.gov or (202) 482–1378. Dated: January 17, 2017. Elizabeth Whiteman, Acting Executive Secretary. [FR Doc. 2017–01708 Filed 1–25–17; 8:45 am] BILLING CODE 3510–DS–P DEPARTMENT OF COMMERCE Foreign-Trade Zones Board [B–08–2017] Foreign-Trade Zone 157—Casper, Wyoming; Application for Reorganization Under Alternative Site Framework An application has been submitted to the Foreign-Trade Zones (FTZ) Board by the Casper/Natrona County International Airport, grantee of FTZ 157, requesting authority to reorganize the zone under the alternative site framework (ASF) adopted by the FTZ Board (15 CFR Sec. 400.2(c)). The ASF is an option for grantees for the establishment or reorganization of zones and can permit significantly greater flexibility in the designation of new subzones or ‘‘usage-driven’’ FTZ sites for operators/users located within a grantee’s ‘‘service area’’ in the context of the FTZ Board’s standard 2,000-acre activation limit for a zone. The application was submitted pursuant to the Foreign-Trade Zones Act, as amended (19 U.S.C. 81a–81u), and the regulations of the Board (15 CFR part 400). It was formally docketed on January 17, 2017. FTZ 157 was approved by the FTZ Board on January 19, 1989 (Board Order 426, 54 FR 5532, February 3, 1989) and expanded on September 3, 2010 (Board Order 1707, 75 FR 56987–56988, September 17, 2010). The current zone includes the following sites: Site 1 (492 acres)— Casper/Natrona County International Airport, 8500 Airport Parkway, Casper; and, Site 2 (984 acres)—Casper Logistics Hub, 6 Mile Road and Morgan Street, Casper. E:\FR\FM\26JAN1.SGM 26JAN1

Agencies

[Federal Register Volume 82, Number 16 (Thursday, January 26, 2017)]
[Notices]
[Pages 8503-8506]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-01767]


========================================================================
Notices
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains documents other than rules 
or proposed rules that are applicable to the public. Notices of hearings 
and investigations, committee meetings, agency decisions and rulings, 
delegations of authority, filing of petitions and applications and agency 
statements of organization and functions are examples of documents 
appearing in this section.

========================================================================


Federal Register / Vol. 82, No. 16 / Thursday, January 26, 2017 / 
Notices

[[Page 8503]]



 DEPARTMENT OF AGRICULTURE

Office of the Secretary


Privacy Act of 1974; Revised System of Records

AGENCY: Office of the Chief Information Officer, USDA.

ACTION: Notice of the revision of Privacy Act system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Department of 
Agriculture proposes to revise an existing Department of Agriculture 
system of records notice now titled, USDA/OCIO-2 eAuthentication 
Service (eAuth). The USDA eAuth provides the public and government 
businesses with a single sign-on capability for USDA applications, 
management of user credentials, and verification of identity, 
authorization, and electronic signatures. USDA's eAuth collects 
customer information through an electronic self-registration process 
provided through the eAuth Web site. This System of Records Notice was 
previously published as ``USDA eAuthentication Service'' in Federal 
Register Vol. 77, No. 50 on Wednesday, March 14, 2012. The revision 
reflects updates to the system name; the system location; routine uses; 
storage policies; safeguards; retention and disposal; identity proofing 
individuals, the system manager; and notification, record access, and 
contesting procedures.

DATES: Submit comments on or before March 7, 2017. This new system will 
be effective March 7, 2017.

ADDRESSES: You may submit comments, identified by docket number USDA/
OCIO-2 by one of the following methods:
     Federal e-Rulemaking Portal: http://www.regulations.gov. 
Follow the instructions for submitting comments.
     Fax: (970) 295-5238.
     Mail: Adam Zeimet, Branch Chief, Identity Access Branch, 
eAuthentication, 2150 Centre Avenue, Building A, Suite 350, Fort 
Collins, Colorado 80526.
     Instructions: All submissions received must include the 
agency name and docket number for this rulemaking. All comments 
received will be posted without change to http://www.regulations.gov, 
including any personal information provided.
     Docket: For access to the docket to read background 
documents or comments received, go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: For general questions, please contact: 
Adam Zeimet, Program Manager, (970) 295-5678, 2150 Centre Avenue, 
Building A, Suite 350, Fort Collins, Colorado 80526. For privacy 
issues, please contact: Kelvin Fairfax, Chief Privacy Officer, 
Technology Planning, Architecture and E-Government, Office of the Chief 
Information Officer, Department of Agriculture, Washington, DC 20250.

SUPPLEMENTARY INFORMATION:

I. Background

    The USDA eAuthentication Service provides USDA Agency customers and 
employee's single sign-on capability and electronic authentication and 
authorization for USDA Web applications and services. Through an online 
self-registration process, USDA Agency customers and employees can 
obtain accounts as authorized users that will provide access to USDA 
resources without needing to re-authenticate within the context of a 
single Internet session. Once an account is activated, users may use 
the associated user ID and password that they created to access USDA 
resources that are protected by eAuthentication. Information stored in 
the eAuthentication Service may be shared with other USDA components, 
as well as appropriate Federal, State, local, tribal, foreign, or 
international government agencies as outlined in the routine uses or 
authorized by statute.
    This sharing will take place only after USDA determines that the 
receiving component or agency has a need to know the information to 
carry out agency mission, national security, law enforcement, 
immigration, intelligence, or other functions consistent with the 
routine uses set forth in this system of records notice. The revisions 
to this system of records include: Updating the system location, 
storage policies, storage safeguards, retention and disposal policies; 
the system manager's location; the practice of identity proofing 
individuals; record retrieval; and the notification, record access, & 
contesting procedures in order to be consistent with the Department's 
best practices.
    In addition, the routine uses were amended as follows:
     Routine Use 1. is modified adding account management and 
user profile management
     Routine Use 8. is added to permit another federal agency 
or federal entity to investigate breaches and remedy risk to 
individuals
     Routine Use 9. is added for disclosure to credit bureaus 
to conduct identity proofing
     Routine Use 10. is added for disclosure for contractors to 
assist in administering the program
     Routine Use 11. Is added for disclosure of records to 
other federal agencies

    Dated: January 18, 2017.
Michael T. Scuse,
Acting Secretary of Agriculture.
SYSTEM OF RECORDS

USDA/OCIO-2

SYSTEM NAME:
    USDA/OCIO-2 eAuthentication Service

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    USDA--National Information Technology Center (NITC), 8930 Ward 
Pkwy, Kansas City, MO 64114.
    USDA--St. Louis Enterprise Data Center, 4300 Goodfellow Boulevard, 
St. Louis, MO 63120 US.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    This system contains records on individuals who applied for and 
were granted access to USDA applications and services that are 
protected by eAuthentication. This includes but not limited to public 
citizens, federal employees, contractor employees, affiliates, etc.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The eAuthentication system will collect the information including 
but

[[Page 8504]]

not limited to name, address, country of residence, telephone, email 
address, date of birth, user name, password, SSN (Capture Temporarily), 
challenge question, and challenge answer. The latter two types of 
information are used to validate a customer's identity for password 
reset. The system will request social security number for online 
identity proofing services through a verification process implemented 
with a credit bureau.

AUTHORITY FOR MAINTENANCE ON THE SYSTEM:
    Government Paperwork Elimination Act (GPEA, Pub. L. 105-277) of 
1998; Freedom to E-File Act (Pub. L. 106-222) of 2000; Electronic 
Signatures in Global and National Commerce Act (E-SIGN, Pub. L. 106-
229) of 2000; eGovernment Act of 2002 (H.R. 2458/Pub. L. 107-347); 
GRAMM-LEACH-BLILEY ACT (Pub L. 106-102).

PURPOSE(S):
    The records in this system are used to electronically authenticate 
and authorize users accessing protected USDA applications and services. 
eAuthentication shares the user information with authorized federal 
agencies or contractor systems supporting a federal agency mission for 
centralized account management and user profile management for USDA.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES. RECORDS IN THIS SYSTEM MAY BE 
DISCLOSED AS FOLLOWS:
    1. To external Web applications or information technology systems 
integrated with the government's federated architecture for 
authentication, identity management, and user profile management for 
USDA. Prior to any disclosure of information under this architecture, 
the user will request access to an external application with their USDA 
credential. All external applications will have undergone rigorous 
testing before joining the architecture. The eAuthentication Service 
acts as a single sign-on point for USDA Agency applications, allowing a 
USDA customer to sign onto any USDA applications for which they have 
been authorized.
    2. When a record on its face, or in conjunction with other records, 
indicates a violation or potential violation of law, whether civil, 
criminal, or regulatory in nature, and whether arising by general 
statute or particular program, statute, or by regulation, rule, or 
order issued pursuant thereto, disclosure may be made to the 
appropriate agency, whether Federal, foreign, State, local, tribal, or 
other public authority responsible for enforcing, investigating, or 
prosecuting such violation or charged with enforcing or implementing 
the statute, or rule, regulation, or order issued pursuant thereto, if 
the information disclosed is relevant to any enforcement, regulatory, 
investigative, or prosecutive responsibility of the receiving entity. 
Referral to the appropriate agency, whether Federal, State, local, or 
foreign, charged with the responsibility of investigating or 
prosecuting violation of law, or of enforcing or implementing a 
statute, rule, regulation, or order issued pursuant thereto, of any 
record within this system when information available indicates a 
violation or potential violation of law, whether civil, criminal, or 
regulatory in nature.
    3. To a court or adjudicative body in a proceeding when: (a) USDA 
or any component thereof; or (b) any employee of USDA in his or her 
official capacity; or (c) any employee of USDA in his or her individual 
capacity where USDA has agreed to represent the employee; or (d) the 
United States Government, is a party to litigation or has an interest 
in such litigation, and by careful review, USDA determines that the 
records are both relevant and necessary to the litigation and the use 
of such records is therefore deemed by USDA to be for a purpose that is 
compatible with the purpose for which USDA collected the records.
    4. To a congressional office in response to an inquiry made at the 
written request of the individual to whom the record pertains.
    5. Disclosure at the individuals' request to any Federal 
department, State, local agencies, or USDA partners including but not 
limited to contractor systems supporting the government mission 
utilizing or interfacing with eAuthentication to provide electronic 
authentication. The disclosure of this information is required to 
securely provide, monitor, and analyze the requested program, service, 
registration, or other transaction.
    6. To the Department of Justice when: (a) USDA or any component 
thereof; or (b) any employee of USDA in his or her official capacity 
where the Department of Justice has agreed to represent the employee; 
or (d) the United States Government, is a party to litigation or has an 
interest in such litigation, and by careful review, USDA determines 
that the records are both relevant and necessary to the litigation and 
the use of such records by the Department of Justice is therefore 
deemed by USDA to be for a purpose that is compatible with the purpose 
for which USDA collected the records.
    7. To appropriate agencies, entities, and persons when (1) USDA 
suspects or has confirmed that the security or confidentiality of 
information in the system of records has been compromised; (2) USDA has 
determined that as a result of the suspected or confirmed breach there 
is a risk of harm to individuals, USDA (including its information 
systems, programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, and 
persons is reasonably necessary to assist in connection with USDA's 
efforts to respond to the suspected or confirmed compromise and 
prevent, minimize, or remedy such harm.
    8. To another Federal agency or Federal entity, when information 
from this system of records is reasonably necessary to assist the 
recipient agency or entity in (1) responding to a suspected or 
confirmed breach or (2) preventing, minimizing, or remedying the risk 
of harm to individuals, the agency (including its information systems, 
programs and operations), the Federal Government, or national security.
    9. Disclosure to credit bureaus to conduct online identity proofing 
of users including but not limited to public citizens, federal 
employees, contractor employees, affiliates, etc., for the purpose of 
remotely verifying the users identity in using eAuthentication account 
management practices (e.g. Issuing an account & credential, and account 
recovery).
    10. Contract Disclosure. If the Department contracts with an entity 
for the purpose of performing any function that requires disclosure of 
records including but not limited to helpdesk operations, password 
resets, system administration, application operations, program support. 
The Department may disclose the records as a routine use to those 
contract employees. Before entering into such a contract, the 
Department shall require the contractor to maintain Privacy Act 
safeguards as required under 5 U.S.C. 552a(m) with respect to the 
records in the system.
    11. Disclosure may be made to a private contractor or Federal 
agency for the purpose of collating, analyzing, aggregating or 
otherwise refining records for official business in this system. The 
contractor or Federal agency will be required to maintain Privacy Act 
safeguards with respect to these records.

[[Page 8505]]

POLICIES/PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND 
DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Records are stored and maintained electronically on USDA owned and 
operated systems in Kansas City, MO and St. Louis, Missouri.

RETRIEVABILITY:
    Records can be retrieved by a search of user profile attributes 
including but not limited to Personal Identity Verification (HSPD-12 
PID) card identifiers, UserName (Login ID), Last Name, First Name, 
Email, system ID (eAuth Internal ID), challenge question, and challenge 
answer. The latter two types of information are used to validate a 
customer's identity for helpdesk services only those individuals with 
approved access rights have this authority and data accessibility. USDA 
staff and contractors (acting as authorized agents) access information 
that is necessary to fulfill customer requests, provide end-user 
technical support and to operate and administer the system.

SAFEGUARDS:
    Records are accessible only to authorized personnel. Protection of 
the records is ensured by appropriate technical controls. The physical 
security of the system is provided by restricted building access. In 
addition, increased security is provided by encryption of data when 
transmitted. SSN is masked during the capture process when a user 
enters on the web form. The system has undergone an Assessment and 
Authorization (A&A) by the OCIO Designated Approving Authority via 
Agricultural Security Operations Center (ASOC).

RETENTION AND DISPOSAL:
    Records in this system will be retained in accordance with approved 
retention schedules, including: (31) General Retention Schedule (DAA-
GRS-2013-0006-0004), which provides for annual cut-off and for 
destruction 6 years after cutoff or longer if required for business 
use; (61) General Retention Schedule (N1-GRS-07-3, item 13a2), which 
provides for annual cut-off and for destruction 7 years and 6 months to 
20 years to 6 months after cut-off; and additional approved schedules 
may apply. Destruction of records shall occur in the manner(s) 
appropriate to the type of record, such as but not limited to shredding 
of paper records and/or deletion of computer records in accordance with 
federal requirements.

SYSTEM MANAGER AND ADDRESS:
    Program Manager--Identity and Access Management, 2150 Centre 
Avenue, Fort Collins, CO 80526

NOTIFICATION PROCEDURE:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the Headquarters or component's FOIA 
Officer, whose contact information can be found at http://www.da.usda.gov/foia.htm under ``contacts.'' If an individual believes 
more than one component maintains Privacy Act records concerning him or 
her the individual may submit the request to the Chief FOIA Officer, 
Department of Agriculture, 1400 Independence Avenue SW., Washington, DC 
20250.
    When seeking records about yourself from this system of records or 
any other Departmental system of records your request must conform with 
the Privacy Act regulations set forth in 6 CFR part 5. You must first 
verify your identity, meaning that you must provide your full name, 
current address and date and place of birth. You must sign your 
request, and your signature must either be notarized or submitted under 
28 U.S.C. 1746, a law that permits statements to be made under penalty 
of perjury as a substitute for notarization. While no specific form is 
required, you may obtain forms for this purpose from the Chief FOIA 
Officer, Department of Agriculture, 1400 Independence Avenue SW., 
Washington, DC 20250. In addition you should provide the following:
     An explanation of why you believe the Department would 
have information on you,
     Identify which component(s) of the Department you believe 
may have the information about you,
     Specify when you believe the records would have been 
created,
     Provide any other information that will help the FOIA 
staff determine which USDA component agency may have responsive 
records,
     If your request is seeking records pertaining to another 
living individual, you must include a statement from that individual 
certifying his/her agreement for you to access his/her records.
    Without this bulleted information the component(s) may not be able 
to conduct an effective search, and your request may be denied due to 
lack of specificity or lack of compliance with applicable regulations.

RECORD ACCESS PROCEDURES:
    See ``Notification procedure'' above.

CONTESTING RECORD PROCEDURES:
    Any individual may contest information contained within a record in 
the system that pertains to him/her by submitting a written request to 
the system manager at the address above. Include the reason for 
contesting the record and the proposed amendment to the information 
with supporting documentation to show how the record is inaccurate.

RECORD SOURCE CATEGORIES:
    Information maintained in the system will be submitted but not 
limited to public citizens, federal employees, contractor employees, 
affiliates, etc.. When a user wishes to transact with USDA or its 
partner organizations electronically, the user must enter name, 
address, country of residence, telephone, date of birth, username, and 
password. To elevate the user to conduct official business with USDA 
the user must be identity proofed requiring social security number 
being queried through a national credit bureau. As the USDA 
eAuthentication Service is integrated with other government or private 
sector authentication systems, data may be obtained from those systems 
to facilitate single-sign on capabilities with the user's permission.

EXEMPTIONS CLAIMED FOR THIS SYSTEM:
    None.
U.S. Department of Agriculture Narrative Statement on Revised 
eAuthentication System of Records Under the Privacy Act of 1974 USDA/
OCIO-2 eAuthentication Service
    The U.S. Department of Agriculture (USDA) eAuthentication Service 
provides USDA Agency customers and employees single sign-on capability 
and electronic authentication and authorization for USDA Web 
applications and services. Through an online self-registration process, 
USDA Agency customers and employees can obtain accounts as authorized 
users that will provide access to USDA resources without needing to re-
authenticate within the context of a single Internet session. Once an 
account is activated, users may use the associated user ID and password 
that they created to access USDA resources that are protected by 
eAuthentication. Information stored in the eAuthentication Service may 
be shared with other USDA components, as well as appropriate Federal, 
State, local, tribal, foreign, or international government agencies as 
outlined in the routine uses or authorized by statute. This sharing 
will take place only after USDA determines that the receiving

[[Page 8506]]

component or agency has a need to know the information to carry out 
national security, law enforcement, immigration, intelligence, or other 
functions consistent with the routine uses set forth in this system of 
records notice. USDA is publishing the routine uses pursuant to which 
it may disclose information about individuals to the extent the 
disclosure is consistent with the purpose for which the information was 
collected. Routine uses include disclosure to external Web applications 
upon user request, to other government agencies for law enforcement 
purposes if the record on its face or in conjunction with other records 
indicates a violation of law, to a court or adjudicative body if 
relevant and necessary to appropriate litigation, to a congressional 
office upon written request of the individual, to other government 
entities of USDA partners upon user request, to USDA contractors or 
industry to identify fraud, waste, or abuse to the Department of 
Justice if relevant and necessary for appropriate litigation, or to 
agencies, entities, or persons to prevent or remedy security breach. 
The authority for maintaining this system is derived from: Government 
Paperwork Elimination Act (GPEA, Pub. L. 105-277) of 1998; Freedom to 
E-File Act (Pub. L. 106-222) of 2000; Electronic Signatures in Global 
and National Commerce Act (E-SIGN, Pub. L. 106-229) of 2000; 
eGovernment Act of 2002 (H.R. 2458).
    Probable or potential effects on the privacy of individuals:
    Although there is some risk to the privacy of individuals, that 
risk is outweighed by the benefits to those individuals who will be 
able to access multiple programs and applications with a single login. 
In addition, the safeguards in place will protect against unauthorized 
disclosure. Records are accessible only to individuals who are 
authorized, and physical and electronic safeguards are employed to 
ensure security. eAuthentication has a current Authority to Operate 
obtained via the completion Certification and Accreditation based on 
the Risk Management Framework. A satisfactory risk assessment has been 
performed.
    OMB information collection requirements:
    OMB information collection approval: OMB No. 0503-0014

[FR Doc. 2017-01767 Filed 1-25-17; 8:45 am]
 BILLING CODE 3410-ZV-P