83_FR_42791 83 FR 42627 - Privacy Act; Implementation

83 FR 42627 - Privacy Act; Implementation

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Federal Register Volume 83, Issue 164 (August 23, 2018)

Page Range42627-42630
FR Document2018-17888

In accordance with the Privacy Act of 1974, as amended (the Act), the Department of Health and Human Services (HHS or Department) is proposing to exempt a new system of records, System No. 09-90-1701, HHS Insider Threat Program Records, from certain requirements of the Act.

Federal Register, Volume 83 Issue 164 (Thursday, August 23, 2018)
[Federal Register Volume 83, Number 164 (Thursday, August 23, 2018)]
[Proposed Rules]
[Pages 42627-42630]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2018-17888]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 5b

RIN 0991-AC10


Privacy Act; Implementation

AGENCY: Department of Health and Human Services.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, as amended (the 
Act), the Department of Health and Human Services (HHS or Department) 
is proposing to exempt a new system of records, System No. 09-90-1701, 
HHS Insider Threat Program Records, from certain requirements of the 
Act.

DATES: Comments on this notice must be received by September 24, 2018.

ADDRESSES: The public should address written comments on this notice by 
email to [email protected] or by mail to the HHS Office of Security and 
Strategic Information (OSSI), 200 Independence Avenue SW, Washington, 
DC 20201.

FOR FURTHER INFORMATION CONTACT: General questions about the NPRM may 
be submitted to the Assistant Deputy Secretary for National Security by 
email to [email protected], by telephone to (202) 690-5756, or by mail to 
the HHS Office of Security and Strategic Information (OSSI), 200 
Independence Avenue SW, Washington, DC 20201.

SUPPLEMENTARY INFORMATION:

I. Background on the Insider Threat Program and New System of Records 
09-90-1701

    Each federal agency is mandated by Presidential Executive Order 
13587, issued October 7, 2011, to establish an insider threat detection 
and prevention program to ensure the security of classified networks 
and the responsible sharing and safeguarding of classified information 
consistent with appropriate protections for privacy and civil 
liberties. The order states in section 2.1:
    The heads of agencies that operate or access classified computer 
networks shall have responsibility for appropriately sharing and 
safeguarding classified information on computer networks. As part of 
this responsibility, they shall implement an insider threat detection 
and prevention program consistent with guidance and standards developed 
by the Insider Threat Task Force established in section 6 of this 
order.
    A threat need not be directed at classified information to threaten 
classified networks. Consequently, insider threats include any of the 
following: Attempted or actual espionage, subversion, sabotage, 
terrorism, or extremist activities directed against the Department and 
its personnel, facilities, information resources, and activities; 
unauthorized use of or intrusion into automated information systems; 
unauthorized disclosure of classified, controlled unclassified, 
sensitive, or proprietary information to technology; indicators of 
potential insider threats or other incidents that may indicate 
activities of an insider threat; and other threats to the Department, 
such as indicators of potential for workplace violence or misconduct.

[[Page 42628]]

    The office that will administer the Department's Insider Threat 
Program, the Office of Security and Strategic Information (OSSI), 
serves as the Department's Federal Intelligence Coordinating Office 
(FICO), which is responsible for coordinating the sharing and 
safeguarding of classified national security information between HHS 
and its operating divisions and with the Office of the Director of 
National Intelligence (ODNI) and its component agencies within the 
Intelligence Community. Within OSSI, the Directorate of Operations 
(Counterintelligence) will oversee the Insider Threat Program; its 
responsibilities include identifying, countering, mitigating, and 
deterring exploitation of HHS personnel, information, assets, and other 
equities by foreign intelligence and security services and agents, 
terrorists, and transnational criminal organizations working under the 
direction of a foreign entity. HHS counterintelligence efforts include 
(1) counterintelligence inquiries and preliminary investigations, (2) 
national security incident investigations, (3) counterintelligence 
analysis, (4) insider threats detection and mitigation efforts, (5) 
counterintelligence and insider threat awareness, and (6) technical 
threat detection and mitigation.
    The records that OSSI compiles to administer the HHS Insider Threat 
Program, which will be covered by System No. 09-90-1701, may be from 
any source, including from any HHS component, office, program, record 
or source, another government agency, or a member of the public; and 
may include records pertaining to information security, personnel 
security, or systems security. This system of records includes 
investigatory material compiled for law enforcement purposes and 
information classified in the interest of national security.
    Note that System No. 09-90-1701 will not cover investigatory 
material that OSSI compiles solely for the purpose of determining 
suitability, eligibility, or qualification for federal civilian 
employment, military service, federal contracts, or access to 
classified information, because such records are covered by other HHS 
systems of records; specifically: 09-90-0002 ``Investigatory Material 
Compiled for Security and Suitability Purposes System'' with respect to 
HHS Office of Inspector General determinations, and 09-90-0020 
``Suitability for Employment Records'' as to all other HHS 
determinations.
    The new system of records will consist of records compiled and used 
by the Department's Office of Security and Strategic Information 
(OSSI), within the Immediate Office of the Secretary (IOS), to 
administer the Department's Insider Threat Program, including law 
enforcement investigatory material and classified intelligence 
information. Such records are eligible to be exempted from certain 
requirements of the Privacy Act under subsections (k)(1) and (k)(2) of 
the Act. The exemptions proposed for those records are necessary and 
appropriate to protect the integrity of insider threat investigations 
and records and prevent disclosure of information that would reveal 
investigation subjects, investigative and security techniques, national 
security information, security sensitive information, personal privacy 
information, and identities of confidential sources and law enforcement 
personnel involved in investigations. Elsewhere in today's Federal 
Register HHS has published a System of Records Notice (SORN) for System 
No. 09-90-1701 for public notice and comment which describes the new 
system of records in more detail.
    The Privacy Act requirements from which HHS is proposing to exempt 
eligible records in System No. 09-90-1701 are those contained in 
subsections (c)(3), (d)(1)-(4), (e)(1), (e)(4)(G), (H), and (I), and 
(f) of the Privacy Act, which require the agency to provide an 
accounting of disclosures; provide notification, access, and amendment 
rights, rules, and procedures; maintain only relevant and necessary 
information; and identify categories of record sources. If the HHS 
Insider Threat Program obtains law enforcement investigatory material 
from another Privacy Act system of records that has been exempted from 
Privacy Act requirements based on subsection (j)(2) of the Act, that 
material will be exempt in System No. 09-90-1701 to the same extent it 
is exempt in the source system, so may be exempt from any of these 
subsections of the Act: (c)(3)-(4); (d)(1)-(4); (e)(1)-(3), (e)(4)(G)-
(I), (e)(5), (e)(8), (e)(12); (f); (g); and (h).

II. Proposed Exemptions and Affected Records

    The Insider Threat Program system of records includes investigatory 
material compiled for law enforcement purposes and information 
classified in the interest of national security. While OSSI does not 
perform criminal law enforcement activity as its principal function, 
OSSI may compile in System No. 09-90-1701 material obtained from other 
agencies or components which perform as their principal function 
activities pertaining to the enforcement of criminal laws, and which 
have exempted their records from certain Privacy Act requirements, 
based on 5 U.S.C. 552a(j)(2). All other investigatory material compiled 
for law enforcement purposes is eligible to be exempted from certain 
Privacy Act requirements based on 5 U.S.C. 552a(k)(2). Information 
classified in the interest of national security is eligible to be 
exempted from certain Privacy Act requirements, based on 5 U.S.C. 
552a(k)(1). Accordingly, the Department is establishing these 
exemptions for System No. 09-90-1701:
     Law enforcement investigatory material that is from 
another system of records in which such material was exempted from 
access and other requirements of the Privacy Act (the Act), based on 5 
U.S.C. 552a(j)(2), will be exempt in System No. 09-901701 on the same 
basis (5 U.S.C. 552a(j)(2)) and from the same requirements as in the 
source system, which may include any of these requirements of the Act: 
(c)(3)-(4); (d)(1)-(4); (e)(1)-(3), (e)(4)(G)-(I), (e)(5), (e)(8), 
(e)(12); (f); (g); and (h);
     All other law enforcement investigatory material in System 
No. 09-90-1701 will be exempt, based on 5 U.S.C. 552a(k)(2), from the 
requirements in subsections (c)(3), (d)(1)-(4), (e)(1), and (e)(4)(G)-
(I), and (f) of the Act, However, if any individual is denied a right, 
privilege, or benefit to which the individual would otherwise be 
entitled by Federal law or for which the individual would otherwise be 
eligible, access will be granted, except to the extent that the 
disclosure would reveal the identity of a source who furnished 
information to the Government under an express promise of 
confidentiality; and
     Information that is classified in the interest of national 
security will be exempt, based on 5 U.S.C. 552a(k)(1), from the 
requirements in subsections (c)(3), (d)(1)-(4), (e)(1), and (e)(4)(G)-
(I), and (f) of the Act.

III. Exemption Rationales

    These exemptions apply only to the extent that information in this 
system is subject to exemption pursuant to 5 U.S.C. 552a(k). Where HHS 
determines compliance would not appear to interfere with or adversely 
affect the purpose of this system to detect, deter, or mitigate insider 
threats, the applicable exemption may be waived by HHS in its sole 
discretion. Exemptions from the particular subsections are necessary 
and appropriate, and justified for the following reasons:
     5 U.S.C. 552a(c)(3) (the requirement to provide 
accountings of disclosures) and 5 U.S.C. 552a(d)(1)-(4) (requirements 
addressing notification, access, and amendment rights,

[[Page 42629]]

collectively referred to herein as access requirements). Providing 
individual record subjects with accountings of disclosures and with 
notification, access, and amendment rights with respect to Insider 
Threat Program records could reveal the existence of an investigation, 
investigative interest, investigative techniques, details about an 
investigation, security-sensitive information such as information about 
security measures and security vulnerabilities, information that must 
remain non-public to protect national security or personal privacy-
identities of law enforcement personnel, or other sensitive or 
classified information. Revealing such information to record subjects 
would thwart or impede pending and future law enforcement 
investigations and efforts to protect national security, and would 
violate personal privacy. Revealing the information would enable record 
subjects or other persons to evade detection and apprehension by 
security and law enforcement personnel; destroy, conceal, or tamper 
with evidence or fabricate testimony; or harass, intimidate, harm, 
coerce, or retaliate against witnesses, complainants, investigators, 
security personnel, law enforcement personnel, or their family members, 
their employees, or other individuals. With respect to investigatory 
material compiled for law enforcement purposes, the exemption pursuant 
to 5 U.S.C. 552a(k)(2) from access requirements in subsection (d) of 
the Act is statutorily limited. If any individual is denied a right, 
privilege, or benefit to which the individual would otherwise be 
entitled by Federal law or for which the individual would otherwise be 
eligible, access will be granted, except to the extent that the 
disclosure would reveal the identity of a source who furnished 
information to the Government under an express promise of 
confidentiality.
     5 U.S.C. 552a(e)(1) (the requirement to maintain only 
relevant and necessary information authorized by statute or Executive 
Order). It will not always be possible to determine at the time 
information is received or compiled in this system of records whether 
the information is or will be relevant and necessary to a law 
enforcement investigation or to protecting national security. For 
example, a tip or lead that does not appear relevant or necessary to 
uncovering an insider threat by itself or at the time the tip or lead 
is received may prove to be relevant and necessary when combined with 
other information that reveals a pattern or that comes to light later.
     5 U.S.C. 552a(e)(4)(G) and (H) (the requirements to 
describe procedures by which subjects may be notified of whether the 
system of records contains records about them and seek access or 
amendment of a record). These requirements concern individual access to 
records, and the records are exempt under (c) and (d), as described 
above. To the extent that (e)(4)(G) and (H) are interpreted to require 
more detailed procedures regarding record notification, access, or 
amendment than have been published in the Federal Register, exemption 
from those provisions is necessary for the same rationale as applies to 
(c) and (d).
     5 U.S.C. 552a(e)(4)(I) (the requirement to describe the 
categories of record sources). To the extent that this subsection is 
interpreted to require a more detailed description regarding the record 
sources in this system than has been published in the Federal Register, 
exemption from this provision is necessary to protect the sources of 
law enforcement and intelligence information and to protect the privacy 
and safety of witnesses and informants and others who provide 
information to HHS. Further, greater specificity of sources of properly 
classified records could compromise national security. Moreover, 
because records used in the Insider Threat Program could come from any 
source, it is not possible to know every category in advance in order 
to list them all in the SORN. Some record source categories may not be 
appropriate to make public in the SORN if, for example, revealing them 
could enable record subjects or other individuals to discover 
investigative techniques and devise ways to bypass them to evade 
detection and apprehension.
     5 U.S.C. 552a(f) (the requirement to promulgate rules to 
implement provisions of the Privacy Act). To the extent that this 
subsection is interpreted to require agency rules addressing the above 
exempted requirements, exemption from this provision is also necessary 
to protect the sources of law enforcement and intelligence information 
and to protect the privacy and safety of witnesses and informants and 
others who provide information to HHS. Greater specificity in 
rulemaking regarding properly classified records could compromise 
national security.

IV. Analysis of Impacts

    The agency has reviewed this rule under Executive Orders 12866 and 
13563, which direct agencies to assess costs and benefits of available 
regulatory alternatives and, if regulation is necessary, to maximize 
the net benefits. The agency believes that this rule is not a 
significant regulatory action under Executive Order 12866, and 
therefore does not constitute an Executive Order 13771 regulatory 
action, because it will not (1) have an annual effect on the economy of 
$100 million or more or adversely affect in a material way the economy, 
a sector of the economy, productivity, competition, jobs, the 
environment, public health or safety, or State, local or tribal 
governments or communities; (2) create a serious inconsistency or 
otherwise interfere with an action taken or planned by another agency; 
(3) materially alter the budgetary impact of entitlements, grants, user 
fees or loan programs, or the rights and obligations of recipients 
thereof; or (4) raise novel legal or policy issues arising out of legal 
mandates, the President's priorities, or the principles set forth in 
Executive Order 12866.
    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. Because the rule imposes no duties or obligations on 
small entities, the Department certifies that the rule will not have a 
significant economic impact on a substantial number of small entities.
    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $144 million, using the most current (2015) Implicit 
Price Deflator for the Gross Domestic Product. The Department does not 
expect that this final rule would result in any one-year expenditure 
that would meet or exceed this amount.

List of Subjects in 45 CFR Part 5b

    Privacy.

    For the reasons stated in the preamble, the Department's Privacy 
Act Regulations, part 5b of 45 CFR Subtitle A, are proposed to be 
amended as follows:

PART 5b--PRIVACY ACT REGULATIONS

0
1. The authority citation for Part 5b continues to read as follows:

    Authority: 5 U.S.C. 301, 5 U.S.C. 552a.


[[Page 42630]]


0
2. Section 5b.11 is amended by adding paragraph (b)(2)(viii)(A) to read 
as follows:


Sec.  5b.11  Exempt systems.

* * * * *
    (b) * * *
    (2) * * *
    (viii) * * *
    (A) HHS Insider Threat Program Records, 09-90-1701.


    Dated: June 29, 2018.
Michael Schmoyer,
Assistant Deputy Secretary for National Security.

    Dated: August 13, 2018.
Alex M. Azar II,
Secretary.
[FR Doc. 2018-17888 Filed 8-22-18; 8:45 am]
BILLING CODE 4151-17-P



                                                                       Federal Register / Vol. 83, No. 164 / Thursday, August 23, 2018 / Proposed Rules                                           42627

                                                 General and Administrative Provisions,                     • Does not have federalism                         records, System No. 09–90–1701, HHS
                                                 and Regulation .04 under COMAR                          implications as specified in Executive                Insider Threat Program Records, from
                                                 26.11.08, Control of Incinerators                       Order 13132 (64 FR 43255, August 10,                  certain requirements of the Act.
                                                 contained in SIP Revision 16–04. As                     1999);                                                DATES: Comments on this notice must be
                                                 described previously, the amendments                       • Is not an economically significant               received by September 24, 2018.
                                                 to COMAR 26.11.01.10, Continuous                        regulatory action based on health or                  ADDRESSES: The public should address
                                                 Opacity Monitoring Requirements, are                    safety risks subject to Executive Order               written comments on this notice by
                                                 as follows: (1) Add a new section 6 to                  13045 (62 FR 19885, April 23, 1997);                  email to hhsinth@hhs.gov or by mail to
                                                 COMAR 26.11.01.10A, Applicability                          • Is not a significant regulatory action           the HHS Office of Security and Strategic
                                                 and Exceptions; (2) amend section 3                     subject to Executive Order 13211 (66 FR               Information (OSSI), 200 Independence
                                                 under COMAR 26.11.01.10B, General                       28355, May 22, 2001);                                 Avenue SW, Washington, DC 20201.
                                                 Requirements for COMs; (3) add new                         • Is not subject to requirements of
                                                                                                                                                               FOR FURTHER INFORMATION CONTACT:
                                                 sections 5 and 6 under COMAR                            section 12(d) of the National
                                                                                                                                                               General questions about the NPRM may
                                                 26.11.01.10B; and (4) remove COMAR                      Technology Transfer and Advancement
                                                                                                                                                               be submitted to the Assistant Deputy
                                                 26.11.01.10F, which has been repealed                   Act of 1995 (15 U.S.C. 272 note) because
                                                                                                                                                               Secretary for National Security by email
                                                 by the State. The amendment to                          application of those requirements would
                                                                                                                                                               to hhsinth@hhs.gov, by telephone to
                                                 COMAR 26.11.08, Control of                              be inconsistent with the CAA; and
                                                                                                                                                               (202) 690–5756, or by mail to the HHS
                                                 Incinerators, consists of an addition of                   • Does not provide EPA with the
                                                                                                                                                               Office of Security and Strategic
                                                 a new section D to Regulation .04,                      discretionary authority to address, as
                                                                                                                                                               Information (OSSI), 200 Independence
                                                 Visible Emissions. EPA has made, and                    appropriate, disproportionate human
                                                                                                                                                               Avenue SW, Washington, DC 20201.
                                                 will continue to make, these materials                  health or environmental effects, using
                                                                                                         practicable and legally permissible                   SUPPLEMENTARY INFORMATION:
                                                 generally available through http://
                                                 www.regulations.gov and at the EPA                      methods, under Executive Order 12898                  I. Background on the Insider Threat
                                                 Region III Office (please contact the                   (59 FR 7629, February 16, 1994).                      Program and New System of Records
                                                 person identified in the FOR FURTHER                       In addition, this proposed rule,                   09–90–1701
                                                 INFORMATION CONTACT section of this                     proposing to approve Maryland SIP
                                                                                                                                                                  Each federal agency is mandated by
                                                 preamble for more information).                         Revision 16–04, COMs requirements for
                                                                                                                                                               Presidential Executive Order 13587,
                                                                                                         MWCs and Cement Plants, does not
                                                 V. Statutory and Executive Order                                                                              issued October 7, 2011, to establish an
                                                                                                         have tribal implications as specified by
                                                 Reviews                                                                                                       insider threat detection and prevention
                                                                                                         Executive Order 13175 (65 FR 67249,
                                                                                                                                                               program to ensure the security of
                                                    Under the CAA, the Administrator is                  November 9, 2000), because the SIP is
                                                                                                                                                               classified networks and the responsible
                                                 required to approve a SIP submission                    not approved to apply in Indian country
                                                                                                                                                               sharing and safeguarding of classified
                                                 that complies with the provisions of the                located in the state, and EPA notes that
                                                                                                                                                               information consistent with appropriate
                                                 CAA and applicable federal regulations.                 it will not impose substantial direct
                                                                                                                                                               protections for privacy and civil
                                                 42 U.S.C. 7410(k); 40 CFR 52.02(a).                     costs on tribal governments or preempt
                                                                                                                                                               liberties. The order states in section 2.1:
                                                 Thus, in reviewing SIP submissions,                     tribal law.
                                                                                                                                                                  The heads of agencies that operate or
                                                 EPA’s role is to approve state choices,                 List of Subjects in 40 CFR Part 52                    access classified computer networks
                                                 provided that they meet the criteria of                                                                       shall have responsibility for
                                                 the CAA. Accordingly, this action                         Environmental protection, Air
                                                                                                         pollution control, Incorporation by                   appropriately sharing and safeguarding
                                                 merely approves state law as meeting                                                                          classified information on computer
                                                 federal requirements and does not                       reference, Intergovernmental relations,
                                                                                                         Particulate matter, Reporting and                     networks. As part of this responsibility,
                                                 impose additional requirements beyond                                                                         they shall implement an insider threat
                                                 those imposed by state law. For that                    recordkeeping requirements.
                                                                                                                                                               detection and prevention program
                                                 reason, this proposed action:                             Authority: 42 U.S.C. 7401 et seq.                   consistent with guidance and standards
                                                    • Is not a ‘‘significant regulatory                    Dated: August 9, 2018.                              developed by the Insider Threat Task
                                                 action’’ subject to review by the Office                Cecil Rodrigues,                                      Force established in section 6 of this
                                                 of Management and Budget under                                                                                order.
                                                                                                         Acting Regional Administrator, Region III.
                                                 Executive Orders 12866 (58 FR 51735,                                                                             A threat need not be directed at
                                                                                                         [FR Doc. 2018–18276 Filed 8–22–18; 8:45 am]
                                                 October 4, 1993) and 13563 (76 FR 3821,                                                                       classified information to threaten
                                                                                                         BILLING CODE 6560–50–P
                                                 January 21, 2011);                                                                                            classified networks. Consequently,
                                                    • Is not an Executive Order 13771 (82                                                                      insider threats include any of the
                                                 FR 9339, February 2, 2017) regulatory                                                                         following: Attempted or actual
                                                 action because SIP approvals are                        DEPARTMENT OF HEALTH AND                              espionage, subversion, sabotage,
                                                 exempted under Executive Order 12866.                   HUMAN SERVICES                                        terrorism, or extremist activities
                                                    • Does not impose an information                                                                           directed against the Department and its
                                                                                                         45 CFR Part 5b
                                                 collection burden under the provisions                                                                        personnel, facilities, information
                                                 of the Paperwork Reduction Act (44                      RIN 0991–AC10                                         resources, and activities; unauthorized
                                                 U.S.C. 3501 et seq.);                                                                                         use of or intrusion into automated
                                                    • Is certified as not having a                       Privacy Act; Implementation                           information systems; unauthorized
                                                 significant economic impact on a                        AGENCY: Department of Health and                      disclosure of classified, controlled
daltland on DSKBBV9HB2PROD with PROPOSALS




                                                 substantial number of small entities                    Human Services.                                       unclassified, sensitive, or proprietary
                                                 under the Regulatory Flexibility Act (5                 ACTION: Notice of proposed rulemaking.                information to technology; indicators of
                                                 U.S.C. 601 et seq.);                                                                                          potential insider threats or other
                                                    • Does not contain any unfunded                      SUMMARY:   In accordance with the                     incidents that may indicate activities of
                                                 mandate or significantly or uniquely                    Privacy Act of 1974, as amended (the                  an insider threat; and other threats to
                                                 affect small governments, as described                  Act), the Department of Health and                    the Department, such as indicators of
                                                 in the Unfunded Mandates Reform Act                     Human Services (HHS or Department) is                 potential for workplace violence or
                                                 of 1995 (Pub. L. 104–4);                                proposing to exempt a new system of                   misconduct.


                                            VerDate Sep<11>2014   16:29 Aug 22, 2018   Jkt 244001   PO 00000   Frm 00018   Fmt 4702   Sfmt 4702   E:\FR\FM\23AUP1.SGM   23AUP1


                                                 42628                 Federal Register / Vol. 83, No. 164 / Thursday, August 23, 2018 / Proposed Rules

                                                    The office that will administer the                  the Department’s Office of Security and               of criminal laws, and which have
                                                 Department’s Insider Threat Program,                    Strategic Information (OSSI), within the              exempted their records from certain
                                                 the Office of Security and Strategic                    Immediate Office of the Secretary (IOS),              Privacy Act requirements, based on 5
                                                 Information (OSSI), serves as the                       to administer the Department’s Insider                U.S.C. 552a(j)(2). All other investigatory
                                                 Department’s Federal Intelligence                       Threat Program, including law                         material compiled for law enforcement
                                                 Coordinating Office (FICO), which is                    enforcement investigatory material and                purposes is eligible to be exempted from
                                                 responsible for coordinating the sharing                classified intelligence information. Such             certain Privacy Act requirements based
                                                 and safeguarding of classified national                 records are eligible to be exempted from              on 5 U.S.C. 552a(k)(2). Information
                                                 security information between HHS and                    certain requirements of the Privacy Act               classified in the interest of national
                                                 its operating divisions and with the                    under subsections (k)(1) and (k)(2) of the            security is eligible to be exempted from
                                                 Office of the Director of National                      Act. The exemptions proposed for those                certain Privacy Act requirements, based
                                                 Intelligence (ODNI) and its component                   records are necessary and appropriate to              on 5 U.S.C. 552a(k)(1). Accordingly, the
                                                 agencies within the Intelligence                        protect the integrity of insider threat               Department is establishing these
                                                 Community. Within OSSI, the                             investigations and records and prevent                exemptions for System No. 09–90–1701:
                                                 Directorate of Operations                               disclosure of information that would                     • Law enforcement investigatory
                                                 (Counterintelligence) will oversee the                  reveal investigation subjects,                        material that is from another system of
                                                 Insider Threat Program; its                             investigative and security techniques,                records in which such material was
                                                 responsibilities include identifying,                   national security information, security               exempted from access and other
                                                 countering, mitigating, and deterring                   sensitive information, personal privacy               requirements of the Privacy Act (the
                                                 exploitation of HHS personnel,                          information, and identities of                        Act), based on 5 U.S.C. 552a(j)(2), will
                                                 information, assets, and other equities                 confidential sources and law                          be exempt in System No. 09–901701 on
                                                 by foreign intelligence and security                    enforcement personnel involved in                     the same basis (5 U.S.C. 552a(j)(2)) and
                                                 services and agents, terrorists, and                    investigations. Elsewhere in today’s                  from the same requirements as in the
                                                 transnational criminal organizations                    Federal Register HHS has published a                  source system, which may include any
                                                 working under the direction of a foreign                System of Records Notice (SORN) for                   of these requirements of the Act: (c)(3)–
                                                 entity. HHS counterintelligence efforts                 System No. 09–90–1701 for public                      (4); (d)(1)–(4); (e)(1)–(3), (e)(4)(G)–(I),
                                                 include (1) counterintelligence inquiries               notice and comment which describes                    (e)(5), (e)(8), (e)(12); (f); (g); and (h);
                                                 and preliminary investigations, (2)                     the new system of records in more                        • All other law enforcement
                                                 national security incident                              detail.                                               investigatory material in System No. 09–
                                                 investigations, (3) counterintelligence                    The Privacy Act requirements from                  90–1701 will be exempt, based on 5
                                                 analysis, (4) insider threats detection                 which HHS is proposing to exempt                      U.S.C. 552a(k)(2), from the requirements
                                                 and mitigation efforts, (5)                             eligible records in System No. 09–90–                 in subsections (c)(3), (d)(1)–(4), (e)(1),
                                                 counterintelligence and insider threat                  1701 are those contained in subsections               and (e)(4)(G)–(I), and (f) of the Act,
                                                 awareness, and (6) technical threat                     (c)(3), (d)(1)–(4), (e)(1), (e)(4)(G), (H),           However, if any individual is denied a
                                                 detection and mitigation.                               and (I), and (f) of the Privacy Act, which            right, privilege, or benefit to which the
                                                    The records that OSSI compiles to                    require the agency to provide an                      individual would otherwise be entitled
                                                 administer the HHS Insider Threat                       accounting of disclosures; provide                    by Federal law or for which the
                                                 Program, which will be covered by                       notification, access, and amendment                   individual would otherwise be eligible,
                                                 System No. 09–90–1701, may be from                      rights, rules, and procedures; maintain               access will be granted, except to the
                                                 any source, including from any HHS                      only relevant and necessary                           extent that the disclosure would reveal
                                                 component, office, program, record or                   information; and identify categories of               the identity of a source who furnished
                                                 source, another government agency, or a                 record sources. If the HHS Insider                    information to the Government under an
                                                 member of the public; and may include                   Threat Program obtains law enforcement                express promise of confidentiality; and
                                                 records pertaining to information                       investigatory material from another                      • Information that is classified in the
                                                 security, personnel security, or systems                Privacy Act system of records that has                interest of national security will be
                                                 security. This system of records                        been exempted from Privacy Act                        exempt, based on 5 U.S.C. 552a(k)(1),
                                                 includes investigatory material                         requirements based on subsection (j)(2)               from the requirements in subsections
                                                 compiled for law enforcement purposes                   of the Act, that material will be exempt              (c)(3), (d)(1)–(4), (e)(1), and (e)(4)(G)–(I),
                                                 and information classified in the                       in System No. 09–90–1701 to the same                  and (f) of the Act.
                                                 interest of national security.                          extent it is exempt in the source system,
                                                    Note that System No. 09–90–1701 will                                                                       III. Exemption Rationales
                                                                                                         so may be exempt from any of these
                                                 not cover investigatory material that                   subsections of the Act: (c)(3)–(4); (d)(1)–              These exemptions apply only to the
                                                 OSSI compiles solely for the purpose of                 (4); (e)(1)–(3), (e)(4)(G)–(I), (e)(5), (e)(8),       extent that information in this system is
                                                 determining suitability, eligibility, or                (e)(12); (f); (g); and (h).                           subject to exemption pursuant to 5
                                                 qualification for federal civilian                                                                            U.S.C. 552a(k). Where HHS determines
                                                 employment, military service, federal                   II. Proposed Exemptions and Affected                  compliance would not appear to
                                                 contracts, or access to classified                      Records                                               interfere with or adversely affect the
                                                 information, because such records are                      The Insider Threat Program system of               purpose of this system to detect, deter,
                                                 covered by other HHS systems of                         records includes investigatory material               or mitigate insider threats, the
                                                 records; specifically: 09–90–0002                       compiled for law enforcement purposes                 applicable exemption may be waived by
                                                 ‘‘Investigatory Material Compiled for                   and information classified in the                     HHS in its sole discretion. Exemptions
daltland on DSKBBV9HB2PROD with PROPOSALS




                                                 Security and Suitability Purposes                       interest of national security. While OSSI             from the particular subsections are
                                                 System’’ with respect to HHS Office of                  does not perform criminal law                         necessary and appropriate, and justified
                                                 Inspector General determinations, and                   enforcement activity as its principal                 for the following reasons:
                                                 09–90–0020 ‘‘Suitability for                            function, OSSI may compile in System                     • 5 U.S.C. 552a(c)(3) (the requirement
                                                 Employment Records’’ as to all other                    No. 09–90–1701 material obtained from                 to provide accountings of disclosures)
                                                 HHS determinations.                                     other agencies or components which                    and 5 U.S.C. 552a(d)(1)–(4)
                                                    The new system of records will                       perform as their principal function                   (requirements addressing notification,
                                                 consist of records compiled and used by                 activities pertaining to the enforcement              access, and amendment rights,


                                            VerDate Sep<11>2014   16:29 Aug 22, 2018   Jkt 244001   PO 00000   Frm 00019   Fmt 4702   Sfmt 4702   E:\FR\FM\23AUP1.SGM   23AUP1


                                                                       Federal Register / Vol. 83, No. 164 / Thursday, August 23, 2018 / Proposed Rules                                               42629

                                                 collectively referred to herein as access                  • 5 U.S.C. 552a(e)(4)(G) and (H) (the              The agency believes that this rule is not
                                                 requirements). Providing individual                     requirements to describe procedures by                a significant regulatory action under
                                                 record subjects with accountings of                     which subjects may be notified of                     Executive Order 12866, and therefore
                                                 disclosures and with notification,                      whether the system of records contains                does not constitute an Executive Order
                                                 access, and amendment rights with                       records about them and seek access or                 13771 regulatory action, because it will
                                                 respect to Insider Threat Program                       amendment of a record). These                         not (1) have an annual effect on the
                                                 records could reveal the existence of an                requirements concern individual access                economy of $100 million or more or
                                                 investigation, investigative interest,                  to records, and the records are exempt                adversely affect in a material way the
                                                 investigative techniques, details about                 under (c) and (d), as described above. To             economy, a sector of the economy,
                                                 an investigation, security-sensitive                    the extent that (e)(4)(G) and (H) are                 productivity, competition, jobs, the
                                                 information such as information about                   interpreted to require more detailed                  environment, public health or safety, or
                                                 security measures and security                          procedures regarding record                           State, local or tribal governments or
                                                 vulnerabilities, information that must                  notification, access, or amendment than               communities; (2) create a serious
                                                 remain non-public to protect national                   have been published in the Federal                    inconsistency or otherwise interfere
                                                 security or personal privacy-identities of              Register, exemption from those                        with an action taken or planned by
                                                 law enforcement personnel, or other                     provisions is necessary for the same                  another agency; (3) materially alter the
                                                 sensitive or classified information.                    rationale as applies to (c) and (d).                  budgetary impact of entitlements,
                                                 Revealing such information to record                       • 5 U.S.C. 552a(e)(4)(I) (the                      grants, user fees or loan programs, or the
                                                 subjects would thwart or impede                         requirement to describe the categories of             rights and obligations of recipients
                                                 pending and future law enforcement                      record sources). To the extent that this              thereof; or (4) raise novel legal or policy
                                                 investigations and efforts to protect                   subsection is interpreted to require a                issues arising out of legal mandates, the
                                                 national security, and would violate                    more detailed description regarding the               President’s priorities, or the principles
                                                 personal privacy. Revealing the                         record sources in this system than has                set forth in Executive Order 12866.
                                                 information would enable record                         been published in the Federal Register,
                                                                                                                                                                  The Regulatory Flexibility Act
                                                 subjects or other persons to evade                      exemption from this provision is
                                                                                                         necessary to protect the sources of law               requires agencies to analyze regulatory
                                                 detection and apprehension by security                                                                        options that would minimize any
                                                 and law enforcement personnel;                          enforcement and intelligence
                                                                                                         information and to protect the privacy                significant impact of a rule on small
                                                 destroy, conceal, or tamper with                                                                              entities. Because the rule imposes no
                                                 evidence or fabricate testimony; or                     and safety of witnesses and informants
                                                                                                         and others who provide information to                 duties or obligations on small entities,
                                                 harass, intimidate, harm, coerce, or                                                                          the Department certifies that the rule
                                                 retaliate against witnesses,                            HHS. Further, greater specificity of
                                                                                                         sources of properly classified records                will not have a significant economic
                                                 complainants, investigators, security                                                                         impact on a substantial number of small
                                                 personnel, law enforcement personnel,                   could compromise national security.
                                                                                                         Moreover, because records used in the                 entities.
                                                 or their family members, their
                                                                                                         Insider Threat Program could come from                   Section 202(a) of the Unfunded
                                                 employees, or other individuals. With
                                                                                                         any source, it is not possible to know                Mandates Reform Act of 1995 requires
                                                 respect to investigatory material
                                                                                                         every category in advance in order to                 that agencies prepare a written
                                                 compiled for law enforcement purposes,
                                                                                                         list them all in the SORN. Some record                statement, which includes an
                                                 the exemption pursuant to 5 U.S.C.
                                                                                                         source categories may not be                          assessment of anticipated costs and
                                                 552a(k)(2) from access requirements in
                                                                                                         appropriate to make public in the SORN                benefits, before proposing ‘‘any rule that
                                                 subsection (d) of the Act is statutorily
                                                                                                         if, for example, revealing them could                 includes any Federal mandate that may
                                                 limited. If any individual is denied a
                                                                                                         enable record subjects or other                       result in the expenditure by State, local,
                                                 right, privilege, or benefit to which the
                                                                                                         individuals to discover investigative                 and tribal governments, in the aggregate,
                                                 individual would otherwise be entitled
                                                                                                         techniques and devise ways to bypass                  or by the private sector, of $100,000,000
                                                 by Federal law or for which the
                                                                                                         them to evade detection and                           or more (adjusted annually for inflation)
                                                 individual would otherwise be eligible,
                                                                                                         apprehension.                                         in any one year.’’ The current threshold
                                                 access will be granted, except to the                      • 5 U.S.C. 552a(f) (the requirement to             after adjustment for inflation is $144
                                                 extent that the disclosure would reveal                 promulgate rules to implement                         million, using the most current (2015)
                                                 the identity of a source who furnished                  provisions of the Privacy Act). To the                Implicit Price Deflator for the Gross
                                                 information to the Government under an                  extent that this subsection is interpreted            Domestic Product. The Department does
                                                 express promise of confidentiality.                     to require agency rules addressing the                not expect that this final rule would
                                                    • 5 U.S.C. 552a(e)(1) (the requirement               above exempted requirements,                          result in any one-year expenditure that
                                                 to maintain only relevant and necessary                 exemption from this provision is also                 would meet or exceed this amount.
                                                 information authorized by statute or                    necessary to protect the sources of law
                                                 Executive Order). It will not always be                 enforcement and intelligence                          List of Subjects in 45 CFR Part 5b
                                                 possible to determine at the time                       information and to protect the privacy                    Privacy.
                                                 information is received or compiled in                  and safety of witnesses and informants
                                                 this system of records whether the                      and others who provide information to                   For the reasons stated in the
                                                 information is or will be relevant and                  HHS. Greater specificity in rulemaking                preamble, the Department’s Privacy Act
                                                 necessary to a law enforcement                          regarding properly classified records                 Regulations, part 5b of 45 CFR Subtitle
                                                 investigation or to protecting national                 could compromise national security.                   A, are proposed to be amended as
daltland on DSKBBV9HB2PROD with PROPOSALS




                                                 security. For example, a tip or lead that                                                                     follows:
                                                 does not appear relevant or necessary to                IV. Analysis of Impacts
                                                 uncovering an insider threat by itself or                  The agency has reviewed this rule                  PART 5b—PRIVACY ACT
                                                 at the time the tip or lead is received                 under Executive Orders 12866 and                      REGULATIONS
                                                 may prove to be relevant and necessary                  13563, which direct agencies to assess
                                                 when combined with other information                    costs and benefits of available regulatory            ■ 1. The authority citation for Part 5b
                                                 that reveals a pattern or that comes to                 alternatives and, if regulation is                    continues to read as follows:
                                                 light later.                                            necessary, to maximize the net benefits.                  Authority: 5 U.S.C. 301, 5 U.S.C. 552a.



                                            VerDate Sep<11>2014   16:29 Aug 22, 2018   Jkt 244001   PO 00000   Frm 00020   Fmt 4702   Sfmt 4702   E:\FR\FM\23AUP1.SGM   23AUP1


                                                 42630                 Federal Register / Vol. 83, No. 164 / Thursday, August 23, 2018 / Proposed Rules

                                                 ■ 2. Section 5b.11 is amended by adding                 Sprint%20Petition%20re%20ASR                          (OOIDA) and TruckerNation.org
                                                 paragraph (b)(2)(viii)(A) to read as                    %20filed%20070918.pdf. The                            (TruckerNation). The Agency
                                                 follows:                                                Commission will not send a                            encourages vendors of electronic logging
                                                                                                         Congressional Review Act (CRA)                        devices (ELDs) to participate to address
                                                 § 5b.11   Exempt systems.                               submission to Congress or the                         potential implementation issues should
                                                 *     *     *  *     *                                  Government Accountability Office                      changes to the HOS rules be made. The
                                                   (b) * * *                                             pursuant to the CRA, 5 U.S.C. because                 listening session will be held in Dallas,
                                                   (2) * * *                                             no rules are being adopted by the                     Texas, and will be webcast for the
                                                   (viii) * * *                                          Commission.                                           benefit of those not able to attend in
                                                   (A) HHS Insider Threat Program                          Subject: IP CTS Modernization                       person. The listening session will allow
                                                 Records, 09–90–1701.                                    Reform, Report and Order and                          interested persons to present comments,
                                                   Dated: June 29, 2018.                                 Declaratory Ruling, FCC 18–79,                        views, and relevant research on topics
                                                 Michael Schmoyer,                                       published at 83 FR 30082, June 27,                    mentioned above. All comments will be
                                                                                                         2018, in CG Docket Nos. 13–24 and 03–                 transcribed and placed in the
                                                 Assistant Deputy Secretary for National
                                                 Security.                                               123. This document is being published                 rulemaking docket for the FMCSA’s
                                                                                                         pursuant to 47 CFR 1.429(e). See also 47              consideration.
                                                   Dated: August 13, 2018.                               CFR 1.4(b)(1) and 1.429(f), (g).
                                                 Alex M. Azar II,                                                                                              DATES: The listening session will be
                                                                                                           Number of Petitions Filed: 2.
                                                 Secretary.                                                Petitions for Reconsideration have                  August 24, 2018, in Dallas, TX., at the
                                                                                                         been filed in the Commission’s                        Kay Bailey Hutchison Convention
                                                 [FR Doc. 2018–17888 Filed 8–22–18; 8:45 am]
                                                                                                         Rulemaking proceeding by Scott R.                     Center, 650 S Griffin St, Dallas, TX
                                                 BILLING CODE 4151–17–P
                                                                                                         Freiermuth, on behalf of Sprint                       75202. The session will begin at 3 p.m.
                                                                                                         Corporation.                                          local time and end at 5 p.m., or earlier,
                                                                                                                                                               if all participants wishing to express
                                                 FEDERAL COMMUNICATIONS                                  Federal Communications Commission.                    their views have done so. Subsequent
                                                 COMMISSION                                              Eliot Greenwald,                                      documents will be published to
                                                                                                         Deputy Chief, Disability Rights Office,               announce dates, times, and locations of
                                                 47 CFR Part 64                                          Consumer and Governmental Affairs Bureau.             the other sessions.
                                                 [CG Docket Nos. 13–24 and 03–123; DA 18–                [FR Doc. 2018–18248 Filed 8–22–18; 8:45 am]           ADDRESSES: The August 24, 2018,
                                                 818]                                                    BILLING CODE 6712–01–P                                meeting will be held at the Kay Bailey
                                                                                                                                                               Hutchison Convention Center, 650 S
                                                 Petitions for Reconsideration of Action
                                                                                                                                                               Griffin St, Dallas, TX 75202.
                                                 in Rulemaking Proceeding                                DEPARTMENT OF TRANSPORTATION                             You may submit comments identified
                                                 AGENCY:  Federal Communications                                                                               by Docket Number FMCSA-2018-0248
                                                 Commission.                                             Federal Motor Carrier Safety                          using any of the following methods:
                                                 ACTION: Petitions for reconsideration.
                                                                                                         Administration                                           • Federal eRulemaking Portal: http://
                                                                                                                                                               www.regulations.gov. Follow the online
                                                 SUMMARY:   The Consumer and                             49 CFR Part 395                                       instructions for submitting comments.
                                                 Governmental Affairs Bureau seeks                       [Docket No. FMCSA–2018–0248]                             • Mail: Docket Management Facility,
                                                 comment on two Petitions for                                                                                  U.S. Department of Transportation, 1200
                                                 Reconsideration (Petitions).                            RIN 2126–AC19                                         New Jersey Avenue SE, West Building,
                                                 DATES: Oppositions to the Petitions                                                                           Ground Floor, Room W12–140,
                                                                                                         Hours of Service                                      Washington, DC 20590–0001.
                                                 must be filed on or before September 7,
                                                 2018. Replies to oppositions must be                    AGENCY:  Federal Motor Carrier Safety                    • Hand Delivery or Courier: West
                                                 filed on or before September 17, 2018.                  Administration (FMCSA), DOT.                          Building, Ground Floor, Room W12–
                                                                                                         ACTION: Notification of public listening              140, 1200 New Jersey Avenue SE,
                                                 ADDRESSES: Federal Communications
                                                                                                         session.                                              Washington, DC, between 9 a.m. and 5
                                                 Commission, 445 12th Street SW,                                                                               p.m., Monday through Friday, except
                                                 Washington, DC 20554.                                   SUMMARY:    The FMCSA announces that it               Federal holidays.
                                                 FOR FUTHER INFORMATION CONTACT:                         will hold a public listening session                     • Fax: 202–493–2251.
                                                 Michael Scott, Consumer and                             concerning potential changes to its                      • Submissions Containing
                                                 Governmental Affairs Bureau, at: (202)                  hours-of-service (HOS) rules for truck                Confidential Business Information (CBI):
                                                 418–1264; email: Michael.Scott@fcc.gov.                 drivers. This will be the first in a series           Mr. Brian Dahlin, Chief, Regulatory
                                                 SUPPLEMENTARY INFORMATION: This is a                    of listening sessions on this topic. On               Analysis Division, 1200 New Jersey
                                                 summary of the Commission’s                             August 21, 2018, FMCSA issued an                      Avenue SE, Washington, DC 20590.
                                                 document, DA 18–818, released August                    Advance Notice of Proposed                               To avoid duplication, please use only
                                                 6, 2018. The full text of the Petitions is              Rulemaking (ANPRM) seeking public                     one of these four methods. See the
                                                 available for viewing and copying at the                comment on four specific aspects of the               ‘‘Public Participation and Request for
                                                 FCC Reference Information Center, 445                   HOS rules for which the Agency is                     Comments’’ portion of the
                                                 12th Street SW, Room CY–A257,                           considering changes: The short-haul                   SUPPLEMENTARY INFORMATION section for
                                                 Washington, DC 20554. It also may be                    HOS limit; the HOS exception for                      instructions on submitting comments,
daltland on DSKBBV9HB2PROD with PROPOSALS




                                                 accessed online via the Commission’s                    adverse driving conditions; the 30-                   including collection of information
                                                 Electronic Comment Filing System at:                    minute rest break provision; and the                  comments for the Office of Information
                                                 https://ecfsapi.fcc.gov/file/10727293                   split-sleeper berth rule to allow drivers             and Regulatory Affairs, OMB.
                                                 1103590/Sprint%20Petition%20for%20                      to split their required time in the sleeper           FOR FURTHER INFORMATION CONTACT: For
                                                 Reconsideration%20                                      berth. In addition, the Agency requested              information on the listening session,
                                                 REDACTED%20VERSION%20                                   public comment on petitions for                       contact Ms. Shannon L. Watson, Senior
                                                 filed%20072718.pdf and https://                         rulemaking from the Owner-Operator                    Advisor to the Associate Administrator
                                                 ecfsapi.fcc.gov/file/107091809005003/                   Independent Drivers Association                       for Policy, Federal Motor Carrier Safety


                                            VerDate Sep<11>2014   16:29 Aug 22, 2018   Jkt 244001   PO 00000   Frm 00021   Fmt 4702   Sfmt 4702   E:\FR\FM\23AUP1.SGM   23AUP1



Document Created: 2018-08-23 00:33:39
Document Modified: 2018-08-23 00:33:39
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionProposed Rules
ActionNotice of proposed rulemaking.
DatesComments on this notice must be received by September 24, 2018.
ContactGeneral questions about the NPRM may be submitted to the Assistant Deputy Secretary for National Security by email to [email protected], by telephone to (202) 690-5756, or by mail to the HHS Office of Security and Strategic Information (OSSI), 200 Independence Avenue SW, Washington, DC 20201.
FR Citation83 FR 42627 
RIN Number0991-AC10

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR