83_FR_50173 83 FR 49981 - Privacy Act of 1974; Department of Transportation, Office of the Secretary of Transportation; DOT/ALL 26; Department of Transportation Insider Threat Program

83 FR 49981 - Privacy Act of 1974; Department of Transportation, Office of the Secretary of Transportation; DOT/ALL 26; Department of Transportation Insider Threat Program

DEPARTMENT OF TRANSPORTATION
Office of the Secretary

Federal Register Volume 83, Issue 192 (October 3, 2018)

Page Range49981-49985
FR Document2018-21441

In accordance with the Privacy Act of 1974, the Department of Transportation (DOT) intends to establish a system of records titled, ``DOT/ALL 26, Insider Threat Program.'' This system of records will allow DOT to administer an insider threat program, including identification of potential external foreign intelligence risks and insider threats, and to maintain information regarding counterintelligence or insider threat inquiries. This system will be included in the Department of Transportation's inventory of record systems.

Federal Register, Volume 83 Issue 192 (Wednesday, October 3, 2018) 
[Federal Register Volume 83, Number 192 (Wednesday, October 3, 2018)]
[Notices]
[Pages 49981-49985]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2018-21441]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Office of the Secretary

[Docket No. OST-2018-0128]


Privacy Act of 1974; Department of Transportation, Office of the 
Secretary of Transportation; DOT/ALL 26; Department of Transportation 
Insider Threat Program

AGENCY: Office of the Departmental Chief Information Officer, Office of 
the Secretary of Transportation, DOT.

ACTION: Notice of Privacy Act system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Department of 
Transportation (DOT) intends to establish a system of records titled, 
``DOT/ALL 26, Insider Threat Program.'' This system of records will 
allow DOT to administer an insider threat program, including 
identification of potential external foreign intelligence risks and 
insider threats, and to maintain information regarding 
counterintelligence or insider threat inquiries. This system will be 
included in the Department of Transportation's inventory of record 
systems.

DATES: Written comments should be submitted on or before November 2, 
2018 The Department may publish an amended SORN in light of any 
comments received. This new system will take effect November 2, 2018.

ADDRESSES: You may submit comments, identified by docket number OST-
2018-0128 by any of the following methods:
     Federal e-Rulemaking Portal: http://www.regulations.gov. 
Follow the instructions for submitting comments.
     Mail: Docket Management Facility, U.S. Department of 
Transportation, 1200 New Jersey Ave. SE, West Building Ground Floor, 
Room W12-140, Washington, DC 20590-0001.
     Hand Delivery or Courier: West Building Ground Floor, Room 
W12-140, 1200 New Jersey Ave. SE, between 9 a.m. and 5 p.m. ET, Monday 
through Friday, except Federal Holidays.
     Fax: (202) 493-2251.
    Instructions: You must include the agency name and docket number 
OST-2018-0128. All comments received will be posted without change to 
http://www.regulations.gov, including any personal information 
provided.
    Privacy Act: Anyone is able to search the electronic form of all 
comments received in any of our dockets by the name of the individual 
submitting the comment (or signing the comment, if submitted on behalf 
of an association, business, labor union, etc.). You may review DOT's 
system of records notice for dockets in the Federal Register notice 
published on January 17, 2008 (73 FR 3316-3317).
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov or to the street 
address listed above. Follow the online instructions for accessing the 
docket.

FOR FURTHER INFORMATION CONTACT: For questions, please contact: Claire 
W. Barrett, Departmental Chief Privacy Officer, Privacy Office, 
Department of Transportation, Washington, DC 20590; [email protected]; or 
(202) 366-8135.

SUPPLEMENTARY INFORMATION: 

I. Background

    In accordance with the Privacy Act of 1974, 5 U.S.C. 552a, the 
United States Department of Transportation (DOT) proposes to create a 
new DOT system of records titled, ``DOT/ALL-26 Insider Threat 
Program.'' This system of records is created as a DOT/ALL system 
because records are maintained for this program by the Office of the 
Secretary (OST) and the Federal Aviation Administration (FAA), two DOT 
components. This system of records notice only applies to records 
maintained by the Office of the Secretary and the Federal Aviation 
Administration's Insider Threat Programs. There are no other components 
within DOT authorized to administer an insider threat program. The term 
``DOT Insider Threat Program'' refers to the insider threat program 
administered by both OST and the FAA.
    Executive Order 13587, Structural Reforms to Improve the Security 
of Classified Networks and the Responsible Sharing and Safeguarding of 
Classified Information, directs Federal departments and agencies to 
establish insider threat programs consistent with guidance and 
standards developed by the National Insider Threat Task Force, which 
was established under section 6 of Executive Order 13587. The National 
Insider Threat Policy and Minimum Standards for Executive Branch 
Insider Threat Programs were issued in November 2012. As described in 
Executive Order 13587 and the National Insider Threat Policy and 
Minimum Standards for Executive Branch Insider Threat Programs, insider 
threat programs are intended to deter and detect insider threats and 
mitigate the risks associated with an individual using his or her 
authorized access to Government information and facilities to do harm 
to the security of the United States. This insider threat may include 
espionage, terrorism, unauthorized

[[Page 49982]]

disclosure of national security information, or the loss or degradation 
of Government resources or capabilities.
    The DOT Insider Threat Program will adhere to Executive Order 13587 
and the National Insider Threat Policy and Minimum Standards for 
Executive Branch Insider Threat Programs, and will include protocols 
for reporting and responding to potential or suspected insider threat 
activity.
    The DOT Insider Threat Program applies to all DOT Operation 
Administrations and Secretarial Offices, and to all DOT employees who 
have access to classified systems (as defined in Executive Order 
13587), as well as to controlled unclassified information or 
information systems, as determined by DOT. For the purposes of the DOT 
Insider Threat Program, Executive Order 12968 defines ``employee'' as 
``a person, other than the President and Vice President, employed by, 
detailed or assigned to, an agency, including members of the Armed 
Forces; an expert or consultant to an agency; an industrial or 
commercial contractor, licensee, certificate holder, or grantee of an 
agency, including all subcontractors; a personal services contractor; 
or any other category of person who acts for or on behalf of an 
agency,'' as determined by the Secretary of Transportation or, for the 
FAA, the FAA Administrator. This definition includes interns and 
students. A licensee, certificate holder (such an airman), or grantee 
who is not also a DOT employee is generally excluded from the DOT 
Insider Threat Program; however, such an individual may be included if 
a determination is made that the nature and extent of that individual's 
access to DOT personnel, facilities, equipment, systems, networks, 
operations, and information necessitates their inclusion.
    Per DOT Order 1642.1, the Department's Defensive 
Counterintelligence and Insider Threat Program Manager within the 
Office of the Secretary oversees the collection, analysis, and 
reporting of information across DOT, including FAA, to support the 
identification and assessment of insider threats. Subject to this 
oversight, OST administers the DOT Insider Threat Program for all DOT 
Operating Administrations except the FAA, which administers the DOT 
Insider Threat Program for itself.
    The DOT Insider Threat Program will maintain information about 
employees who demonstrate indicia of potential insider threats. Indicia 
of potential insider threats may be identified to the DOT Insider 
Threat Program through referrals or the Insider Threat Program office's 
review/analysis of DOT information assets (together, referred to as 
``reports''). Reports of potential insider threats can come from a 
variety of sources, including other Federal agencies, DOT employees, 
and Insider Threat program staff. The DOT Insider Threat Program will 
review reports in accordance with established DOT and FAA Insider 
Threat Program management policy and procedures, as applicable. Based 
on this review, an appropriate authorized OST or FAA official will 
determine whether to proceed with an insider threat inquiry, refer the 
matter to appropriate law enforcement officials, close the matter, or 
take other appropriate action. Insider threat inquiries will be 
comprised primarily of existing DOT information assets including, but 
not limited to, records from information security, personnel security, 
and human resources; and may include information obtained from other 
Federal agencies or from publicly available resources (such as internet 
searches). The DOT Insider Threat Program records also will be used to 
track reports of indicia of potential insider threats, whether or not 
an inquiry was opened; the rationale for opening or not opening an 
inquiry; the disposition of all inquiries, and referrals to law 
enforcement (such as the DOT Office of the Inspector General or the 
Federal Bureau of Investigation); and to report on DOT's Insider Threat 
Program activities.
    In addition to the General Routine Uses applicable to all DOT 
systems of records, the Department may disclose information from this 
system to third parties, only to the extent necessary and relevant to 
an insider threat inquiry conducted by DOT or FAA. The DOT also may 
disclose information from this system to other Federal agencies, when 
necessary and relevant to an insider threat inquiry conducted by that 
Federal agency. These routine uses are compatible with the purposes for 
which the information was collected because individuals who have 
authorized access to classified or controlled unclassified information 
are aware that the Federal Government must take steps, such as sharing 
information with other Federal agencies, when necessary to obtain 
additional information relevant to the subject matter of an insider 
threat inquiry. It must also protect these assets from unauthorized 
access, use, and disclosure, including regularly evaluating/re-
evaluating individuals' suitability for employment and for access to 
classified or sensitive but unclassified information and information 
systems.
    This new system will be included in DOT's inventory of record 
systems.

II. Privacy Act

    The Privacy Act (5 U.S.C. 552a) governs the means by which the 
Federal Government collects, maintains, and uses personally 
identifiable information (PII) in a System of Records. A ``System of 
Records'' is a group of any records under the control of a Federal 
agency from which information about individuals is retrieved by name or 
other personal identifier. The Privacy Act requires each agency to 
publish in the Federal Register a System of Records notice (SORN) 
identifying and describing each System of Records the agency maintains, 
including the purposes for which the agency uses PII in the system, the 
routine uses for which the agency discloses such information outside 
the agency, and how individuals to whom a Privacy Act record pertains 
can exercise their rights under the Privacy Act (e.g., to determine if 
the system contains information about them and to contest inaccurate 
information).
    In a notice of proposed rulemaking, which will be published 
separately in the Federal Register, the Department is proposing 
exempting this system from certain provisions of the Privacy Act, 
pursuant to 5 U.S.C. 552a(k)(1) and (k)(2).
    In accordance with 5 U.S.C. 552a(r), DOT has provided a report of 
this system of records to the Office of Management and Budget and to 
Congress.
SYSTEM NAME AND NUMBER
    Department of Transportation (DOT)/ALL--26, Insider Threat Program

SECURITY CLASSIFICATION:
    Most of the records in this system are unclassified or controlled 
unclassified information; however, the system also may include records 
that are classified.

SYSTEM LOCATION:
    Records are maintained in the DOT, Office of the Secretary, and 
Federal Aviation Administration at their headquarters in Washington, 
DC.

SYSTEM MANAGERS:
    DOT, Office of Intelligence, Security and Emergency Response, 1200 
New Jersey Ave. SE, Washington, DC 20590.
    FAA, Assistant Administrator for Security and Hazardous Materials 
Safety, 800 Independence Avenue SW, Washington, DC 20591.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    5 U.S.C. 3381 (section 811 of the Intelligence Authorization Act 
for Fiscal Year 1995); Executive Order 10450, Security Requirements for 
Government

[[Page 49983]]

Employment (April 17, 1953); Executive Order 12444; Executive Order 
10865, Safeguarding Classified Information within Industry (Jan. 7, 
1961); Executive Order 12829, National Industrial Security Program 
(Jan. 6, 1993); Executive Order 12968, Access to Classified Information 
(Aug. 2, 1995); Executive Order 13567, Reforming Processes Related to 
Suitability for Government Employment, Fitness for Contractor 
Employees, and Eligibility for Access to Classified National Security 
Information (June 30, 2008); Executive Order 13488, Granting 
Reciprocity on Excepted Service and Federal Contractor Employee Fitness 
and Reinvestigating Individuals in Positions of Public Trust (Jan. 16, 
2009); Executive Order 13526, Classified National Security Information 
(Jan. 5, 2010); Executive Order 13587, Structural Reforms to Improve 
the Security of Classified Networks and the Responsible Sharing and 
Safeguarding of Classified Information (Oct. 7, 2011); 49 U.S.C. 40113, 
49 U.S.C. 44701(a)(5).

PURPOSE(S) OF THE SYSTEM:
    The purpose of this system is to receive and respond to reports of 
potential insider threats, manage and track insider threat inquiries 
and law enforcement referrals, and identify potential insider threats 
to DOT information assets.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Current and former DOT employees, including contractors, 
subcontractors, experts, consultants, licensees, certificate holders, 
grantees, interns, students, or any other category of person who acts 
on behalf of DOT and has authorized access to classified or controlled 
unclassified information, as determined by the Secretary of 
Transportation or Administrator of the Federal Aviation Administration.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Categories of records in the system will include reports of indicia 
of insider threat activity, and information relevant and necessary to 
DOT's evaluation of those reports and the conduct of an insider threat 
inquiry. These records may include information obtained from DOT 
Operating Administrations, other Federal agencies, or publicly 
available sources, including, but not limited to, personnel security 
records, administrative adjudication records, regulatory records, 
incident reports, personnel records, network or building access 
records, identification media records, law enforcement records, 
financial records, and travel records. Information derived from these 
record sources may include full name; former names/aliases; date and 
place of birth; social security number; hair and eye color; ethnicity 
and race; gender; biometric data; mother's maiden name; current and 
former home and work addresses, phone numbers, and email addresses; 
employment history; military history; education history; criminal 
history; court actions; credit reports; financial information, 
including financial disclosure filings; personnel security 
adjudications and eligibility decisions; spouse, cohabitant, or 
relative names, dates and places of birth, social security numbers, and 
citizenship information; foreign contacts and activities; travel 
records or briefings; polygraph examination reports; document control 
registries; facility access records; security violation files; and 
requests for access to classified information. This system also 
includes reports of indicia of potential insider threats and 
counterintelligence referrals, insider threat inquiry reports, and 
referrals to law enforcement.

RECORD SOURCE CATEGORIES:
    Records are obtained from existing DOT record systems, publicly-
available sources, Federal agencies, DOT employees, or individuals who 
are the subject of such records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) of the Privacy Act, all or a portion of the records or 
information contained in this system may be disclosed outside DOT as a 
routine use pursuant to 5 U.S.C. 552a(b)(3):
    (1) To third parties only to the extent necessary and relevant to a 
DOT or FAA insider threat inquiry;
    (2) To any Federal agency with responsibilities for activities 
related to counterintelligence or the detection of insider threats, for 
the purpose of conducting such activities;

DOT General Routine Uses
    (3) To the appropriate agency, whether Federal, State, local, or 
foreign, charged with the responsibility of implementing, 
investigating, prosecuting, or enforcing a statute, regulation, rule or 
order, when a record in this system indicates a violation or potential 
violation of law, whether civil, criminal, or regulatory in nature, 
including any records from this system relevant to the implementation, 
investigation, prosecution, or enforcement of the statute, regulation, 
rule, or order that was or may have been violated;
    (4) To a Federal, State, or local agency maintaining civil, 
criminal, or other relevant enforcement information or other pertinent 
information, such as current licenses, if necessary for DOT to obtain 
information relevant to a DOT decision concerning the hiring or 
retention or an employee, the issuance of a security clearance, the 
letting of a contract, or the issuance of a license, grant or other 
benefit;
    (5) To a Federal agency, upon its request, in connection with the 
requesting Federal agency's hiring or retention of an employee, the 
issuance of a security clearance, the reporting of an investigation or 
an employee, the letting of a contract, or the issuance of a license, 
grant, or other benefit by the requesting agency, to the extent that 
the information requested is relevant and necessary to the requesting 
agency's decision on the matter;
    (6) To the Department of Justice, or any other Federal agency 
conducting litigation, when (a) DOT, (b) any DOT employee, in his/her 
official capacity, or in his/her individual capacity if the Department 
of Justice has agreed to represent the employee, or (c) the United 
States or any agency thereof, is a party to litigation or has an 
interest in litigation, and DOT determines that the use of the records 
by the Department of Justice or other Federal agency conducting the 
litigation is relevant and necessary to the litigation; provided, 
however, that DOT determines, in each case, that disclosure of the 
records in the litigation is a use of the information contained in the 
records that is compatible with the purpose for which the records where 
collected.
    (7) To parties in proceedings before any court or adjudicative or 
administrative body before which DOT appears when (a) DOT, (b) any DOT 
employee in his or her official capacity, or in his or her individual 
capacity where DOT has agreed to represent the employee, or (c) the 
United States or any agency thereof is a party to litigation or has an 
interest in the proceeding, and DOT determined that is relevant and 
necessary to the proceeding; provided, however, that DOT determines, in 
each case, that disclosure of the records in the proceeding is a use of 
the information contained in the records that is compatible with the 
purpose for which the records where collected.
    (8) To the Office of Management and Budget (OMB) in connection with 
the review of privacy relief legislation as set forth in OMB Circular 
A-19 at any stage of the legislative coordination and

[[Page 49984]]

clearance process set forth in that Circular.
    (9) To the National Archives and Records Administration for an 
inspection under 44 U.S.C. 2904 and 2906.
    (10) To another agency or instrumentality of any government 
jurisdiction for use in law enforcement activities, either civil or 
criminal, or to expose fraudulent claims; however, this routine use 
only permits the disclosure of names pursuant to a computer matching 
program that otherwise complies with the requirements of the Privacy 
Act.
    (11) To the Attorney General of the United States, or his/her 
designee, information indicating that a person meets any of the 
disqualifications for receipt, possession, shipment, or transport of a 
firearm under the Brady Handgun Violence Prevention Act. In case of a 
dispute concerning the validity of the information provided by DOT to 
the Attorney General (or designee), it shall be a routine use of the 
information in this system to make any disclosures of such information 
to the National Background Check System, established by the Brady 
Handgun Violence Prevention Act, as may be necessary to resolve such 
dispute.
    (12) To appropriate agencies, entities, and persons, when (1) DOT 
suspects or has confirmed that the security or confidentiality of 
information in the system of records has been compromised; (2) DOT has 
determined that as a result of the suspected or confirmed compromise 
there is a risk of harm to economic or property interests, identity 
theft or fraud, or harm to the security or integrity of this system or 
other systems or programs (whether maintained by DOT or not) that rely 
on the compromised information; and (3) the disclosure made to such 
agencies, entities, or persons is reasonably necessary to assist in 
connection with DOT's efforts to respond to the suspected or confirmed 
compromise and prevent, minimize, or remedy such harm.
    (13) To the Office of Government Information Services (OGIS) for 
the purpose of resolving disputes between requesters seeking 
information under the Freedom of Information Act (FOIA) and DOT, or 
OGIS' review of DOT's policies, procedures, and compliance with FOIA.
    (14) To DOT's contractors and their agents, DOT's experts, 
consultants, and others performing or working on a contract, service, 
cooperative agreement, or other assignment for DOT, when necessary to 
accomplish an agency function related to this system of records.
    (15) To an agency, organization, or individual for the purpose of 
performing an audit or oversight related to this system or records, 
provided that DOT determines the records are necessary and relevant to 
the audit or oversight activity. This routine use does not apply to 
intra-agency sharing authorized under Section (b)(1) of the Privacy 
Act.
    (16) To a Federal, State, local, tribal, foreign government, or 
multinational agency, either in response to a request or upon DOT's 
initiative, terrorism information (6 U.S.C. 485(a)(5), homeland 
security information (6 U.S.C. 482(f)(1), or law enforcement 
information (Guideline 2, report attached to White House Memorandum, 
``Information Sharing Environment,'' Nov. 22, 2006), when DOT finds 
that disclosure of the record is necessary and relevant to detect, 
prevent, disrupt, preempt, or mitigate the effects of terrorist 
activities against the territory, people, and interests of the United 
States, as contemplated by the Intelligence Reform and Terrorism 
Prevention Act of 2004, Public Law 108-456, and Executive Order 13388 
(Oct. 25, 2005).

DISCLOSURE TO CONSUMER REPORTING AGENCIES:
    None.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records in this system are stored electronically and/or on paper in 
secure facilities.

POLICIES AND PRACTICES FOR RETREIVEAL OF RECORDS:
    Records may be retrieved by individual's name or DOT- or FAA-
assigned case number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    The records in this system are covered by National Archives and 
Records Administration Schedule 5.6, items 230 and 240. Records 
determined to be associated with an insider threat or to have potential 
to be associated with an insider threat are destroyed 25 years after 
the date the threat was discovered, but a longer retention is 
authorized if required for business use. User attributed data collected 
to monitor user activities on a network to enable insider threat 
programs and activities to support authorized inquiries and 
investigations, is destroyed five years after an inquiry was opened, 
but a longer retention period is authorized if required for business 
use.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Records in this system are safeguarded in accordance with 
applicable rules and policies, including all applicable DOT automated 
systems security and access policies. Strict controls have been imposed 
to minimize the risk of compromising the information that is being 
stored. Access to records in this system is limited to those 
individuals who have a need to know the information for the performance 
of their official duties and who have appropriate clearances or 
permissions.

RECORD ACCESS PROCEDURES:
    Individual seeking access to records in this system of records 
should follow the procedures described in the section ``Notification 
procedure'' below.

CONTESTING RECORD PROCEDURES:
    Individuals seeking amendment to the records in this system of 
records should follow the procedures described in the section 
``Notification procedure'' below.

NOTIFICATION PROCEDURES:
    The Secretary of Transportation has exempted this system from the 
notification, access, and amendment procedures of the Privacy Act 
because it may contain classified information, and includes allegations 
and inquiries about potential unauthorized disclosure of classified or 
controlled unclassified information in violation of federal law. 
However, DOT/FAA will consider individual requests to determine whether 
or not the information requested may be released. Thus, individuals who 
seek notification of and access to any record contained in this system, 
or who seek to contest its content, may submit a request for such 
information to the DOT or FAA. Individuals seeking access to records in 
this system maintained by the DOT Insider Threat Program should submit 
a request to the DOT or FAA System Manager identified at the address 
listed under ``System Manager and Address,'' above.
    When seeking records about yourself from this system of records or 
any other Departmental system of records your request must conform with 
the Privacy Act regulations set forth in 49 CFR part 10. You must sign 
your request, and your signature must either be notarized or submitted 
under 28 U.S.C. 1746, a law that permits statements to be made under 
penalty of perjury as a substitute for notarization. If your request is 
seeking records pertaining to another living individual, you must 
include a statement from that individual

[[Page 49985]]

certifying his/her agreement for you to access his/her records.

EXEMPTIONS CLAIMED FOR THE SYSTEM:
    This system contains classified and unclassified records that are 
exempt from the following provisions of the Privacy Act pursuant to 5 
U.S.C. 552a(k)(1) and (k)(2): (c)(3), (d), (e)(1), (e)(4)(G)-(I), and 
(f).

HISTORY
    This is a new system of records.

Claire W. Barrett,
Departmental Chief Privacy Officer.
[FR Doc. 2018-21441 Filed 10-2-18; 8:45 am]
 BILLING CODE P

Federal Register / Vol. 83, No. 192 / Wednesday, October 3, 2018 / Notices 49981 issued such certification within the DEPARTMENT OF TRANSPORTATION business, labor union, etc.). You may preceding six-month period. review DOT’s system of records notice Approximately 100 carriers from Office of the Secretary for dockets in the Federal Register roughly 30 distinct homelands use OST notice published on January 17, 2008 [Docket No. OST–2018–0128] Form 4540 to apply for statements of (73 FR 3316–3317). authorization annually. We estimate Privacy Act of 1974; Department of Docket: For access to the docket to that one foreign carrier from any given Transportation, Office of the Secretary read background documents or homeland will expend roughly 4 hours of Transportation; DOT/ALL 26; comments received, go to http:// every six-months to obtain certification Department of Transportation Insider www.regulations.gov or to the street from its homeland governments.3 We Threat Program address listed above. Follow the online have apportioned 30 minutes to each instructions for accessing the docket. AGENCY: Office of the Departmental FOR FURTHER INFORMATION CONTACT: For application to account for the time Chief Information Officer, Office of the required to obtain certifications from questions, please contact: Claire W. Secretary of Transportation, DOT. Barrett, Departmental Chief Privacy homeland governments. ACTION: Notice of Privacy Act system of Officer, Privacy Office, Department of We have no empirical data to indicate records. Transportation, Washington, DC 20590; how much time is required for a person privacy@dot.gov; or (202) 366–8135. to complete OST Form 4540; however, SUMMARY: In accordance with the SUPPLEMENTARY INFORMATION: anecdotal evidence reveals that Privacy Act of 1974, the Department of respondents spend thirty (30) minutes Transportation (DOT) intends to I. Background or less completing the form and brief establish a system of records titled, In accordance with the Privacy Act of justification. In some cases, respondents ‘‘DOT/ALL 26, Insider Threat Program.’’ 1974, 5 U.S.C. 552a, the United States spend a limited amount of time, less This system of records will allow DOT Department of Transportation (DOT) than ten (10) minutes, reviewing the to administer an insider threat program, proposes to create a new DOT system of form before sending it via facsimile or including identification of potential records titled, ‘‘DOT/ALL–26 Insider email to the Department. In the interest external foreign intelligence risks and Threat Program.’’ This system of records insider threats, and to maintain is created as a DOT/ALL system because of providing a conservative estimate so information regarding records are maintained for this program as to not understate the burden hours, counterintelligence or insider threat by the Office of the Secretary (OST) and we estimate the hour burden for inquiries. This system will be included completing OST Form 4540 as thirty the Federal Aviation Administration in the Department of Transportation’s (FAA), two DOT components. This (30) minutes. inventory of record systems. system of records notice only applies to Public Comments Invited: You are DATES: Written comments should be records maintained by the Office of the asked to comment on any aspect of this submitted on or before November 2, Secretary and the Federal Aviation information collection, including: (1) 2018 The Department may publish an Administration’s Insider Threat Whether the proposed collection is amended SORN in light of any Programs. There are no other necessary for the Office of the comments received. This new system components within DOT authorized to Secretary’s performance; (2) the will take effect November 2, 2018. administer an insider threat program. accuracy of the estimated burden; (3) ADDRESSES: You may submit comments, The term ‘‘DOT Insider Threat Program’’ ways for the Office of the Secretary to identified by docket number OST– refers to the insider threat program enhance the quality, usefulness, and 2018–0128 by any of the following administered by both OST and the FAA. clarity of the collected information; and methods: Executive Order 13587, Structural (4) ways that the burden could be • Federal e-Rulemaking Portal: http:// Reforms to Improve the Security of minimized without reducing the quality www.regulations.gov. Follow the Classified Networks and the Responsible of the collected information. The agency instructions for submitting comments. Sharing and Safeguarding of Classified will summarize and/or include your • Mail: Docket Management Facility, Information, directs Federal comments in the request for OMB’s U.S. Department of Transportation, 1200 departments and agencies to establish clearance of this information collection. New Jersey Ave. SE, West Building insider threat programs consistent with Ground Floor, Room W12–140, guidance and standards developed by All responses to this notice will be Washington, DC 20590–0001. the National Insider Threat Task Force, summarized and included in the request • Hand Delivery or Courier: West which was established under section 6 for OMB approval. All comments will Building Ground Floor, Room W12–140, of Executive Order 13587. The National also become a matter of public record. 1200 New Jersey Ave. SE, between 9 Insider Threat Policy and Minimum Issued in Washington, DC, on September a.m. and 5 p.m. ET, Monday through Standards for Executive Branch Insider 14, 2018. Friday, except Federal Holidays. Threat Programs were issued in Brian J. Hedberg, • Fax: (202) 493–2251. November 2012. As described in Director, Office of the International Aviation. Instructions: You must include the Executive Order 13587 and the National [FR Doc. 2018–20494 Filed 10–2–18; 8:45 am] agency name and docket number OST– Insider Threat Policy and Minimum 2018–0128. All comments received will Standards for Executive Branch Insider BILLING CODE 4910–9X–P be posted without change to http:// Threat Programs, insider threat www.regulations.gov, including any programs are intended to deter and daltland on DSKBBV9HB2PROD with NOTICES personal information provided. detect insider threats and mitigate the 3 Calculation: (4 burden hours per application) × Privacy Act: Anyone is able to search risks associated with an individual the electronic form of all comments using his or her authorized access to (30 foreign homelands) × (2 requests per year) = 240 annual burden hours. Apportioning 240 annual received in any of our dockets by the Government information and facilities burden hours equally among an average of 430 name of the individual submitting the to do harm to the security of the United applications annually = approximately 30 burden comment (or signing the comment, if States. This insider threat may include minutes per application. submitted on behalf of an association, espionage, terrorism, unauthorized VerDate Sep<11>2014 18:05 Oct 02, 2018 Jkt 247001 PO 00000 Frm 00077 Fmt 4703 Sfmt 4703 E:\FR\FM\03OCN1.SGM 03OCN1

49982 Federal Register / Vol. 83, No. 192 / Wednesday, October 3, 2018 / Notices disclosure of national security information assets (together, referred to II. Privacy Act information, or the loss or degradation as ‘‘reports’’). Reports of potential The Privacy Act (5 U.S.C. 552a) of Government resources or capabilities. insider threats can come from a variety governs the means by which the Federal The DOT Insider Threat Program will of sources, including other Federal Government collects, maintains, and adhere to Executive Order 13587 and agencies, DOT employees, and Insider uses personally identifiable information the National Insider Threat Policy and Threat program staff. The DOT Insider (PII) in a System of Records. A ‘‘System Minimum Standards for Executive Threat Program will review reports in of Records’’ is a group of any records Branch Insider Threat Programs, and accordance with established DOT and under the control of a Federal agency will include protocols for reporting and FAA Insider Threat Program from which information about responding to potential or suspected management policy and procedures, as individuals is retrieved by name or insider threat activity. applicable. Based on this review, an The DOT Insider Threat Program other personal identifier. The Privacy appropriate authorized OST or FAA applies to all DOT Operation Act requires each agency to publish in official will determine whether to Administrations and Secretarial Offices, the Federal Register a System of proceed with an insider threat inquiry, and to all DOT employees who have Records notice (SORN) identifying and refer the matter to appropriate law access to classified systems (as defined describing each System of Records the enforcement officials, close the matter, in Executive Order 13587), as well as to agency maintains, including the or take other appropriate action. Insider controlled unclassified information or purposes for which the agency uses PII threat inquiries will be comprised information systems, as determined by in the system, the routine uses for primarily of existing DOT information DOT. For the purposes of the DOT which the agency discloses such assets including, but not limited to, Insider Threat Program, Executive Order records from information security, information outside the agency, and 12968 defines ‘‘employee’’ as ‘‘a person, personnel security, and human how individuals to whom a Privacy Act other than the President and Vice resources; and may include information record pertains can exercise their rights President, employed by, detailed or obtained from other Federal agencies or under the Privacy Act (e.g., to determine assigned to, an agency, including from publicly available resources (such if the system contains information about members of the Armed Forces; an expert as internet searches). The DOT Insider them and to contest inaccurate or consultant to an agency; an industrial Threat Program records also will be information). or commercial contractor, licensee, used to track reports of indicia of In a notice of proposed rulemaking, certificate holder, or grantee of an potential insider threats, whether or not which will be published separately in agency, including all subcontractors; a an inquiry was opened; the rationale for the Federal Register, the Department is personal services contractor; or any opening or not opening an inquiry; the proposing exempting this system from other category of person who acts for or disposition of all inquiries, and referrals certain provisions of the Privacy Act, on behalf of an agency,’’ as determined to law enforcement (such as the DOT pursuant to 5 U.S.C. 552a(k)(1) and by the Secretary of Transportation or, Office of the Inspector General or the (k)(2). for the FAA, the FAA Administrator. Federal Bureau of Investigation); and to In accordance with 5 U.S.C. 552a(r), This definition includes interns and report on DOT’s Insider Threat Program DOT has provided a report of this students. A licensee, certificate holder activities. system of records to the Office of (such an airman), or grantee who is not In addition to the General Routine Management and Budget and to also a DOT employee is generally Uses applicable to all DOT systems of Congress. excluded from the DOT Insider Threat records, the Department may disclose SYSTEM NAME AND NUMBER Program; however, such an individual information from this system to third may be included if a determination is parties, only to the extent necessary and Department of Transportation (DOT)/ made that the nature and extent of that relevant to an insider threat inquiry ALL—26, Insider Threat Program individual’s access to DOT personnel, conducted by DOT or FAA. The DOT SECURITY CLASSIFICATION: facilities, equipment, systems, networks, also may disclose information from this operations, and information necessitates Most of the records in this system are system to other Federal agencies, when their inclusion. unclassified or controlled unclassified necessary and relevant to an insider Per DOT Order 1642.1, the threat inquiry conducted by that Federal information; however, the system also Department’s Defensive agency. These routine uses are may include records that are classified. Counterintelligence and Insider Threat compatible with the purposes for which SYSTEM LOCATION: Program Manager within the Office of the information was collected because Records are maintained in the DOT, the Secretary oversees the collection, individuals who have authorized access Office of the Secretary, and Federal analysis, and reporting of information to classified or controlled unclassified Aviation Administration at their across DOT, including FAA, to support information are aware that the Federal headquarters in Washington, DC. the identification and assessment of Government must take steps, such as insider threats. Subject to this oversight, sharing information with other Federal SYSTEM MANAGERS: OST administers the DOT Insider Threat agencies, when necessary to obtain DOT, Office of Intelligence, Security Program for all DOT Operating additional information relevant to the and Emergency Response, 1200 New Administrations except the FAA, which subject matter of an insider threat Jersey Ave. SE, Washington, DC 20590. administers the DOT Insider Threat inquiry. It must also protect these assets FAA, Assistant Administrator for Program for itself. from unauthorized access, use, and Security and Hazardous Materials The DOT Insider Threat Program will disclosure, including regularly Safety, 800 Independence Avenue SW, daltland on DSKBBV9HB2PROD with NOTICES maintain information about employees evaluating/re-evaluating individuals’ Washington, DC 20591. who demonstrate indicia of potential suitability for employment and for insider threats. Indicia of potential access to classified or sensitive but AUTHORITY FOR MAINTENANCE OF THE SYSTEM: insider threats may be identified to the unclassified information and 5 U.S.C. 3381 (section 811 of the DOT Insider Threat Program through information systems. Intelligence Authorization Act for Fiscal referrals or the Insider Threat Program This new system will be included in Year 1995); Executive Order 10450, office’s review/analysis of DOT DOT’s inventory of record systems. Security Requirements for Government VerDate Sep<11>2014 18:05 Oct 02, 2018 Jkt 247001 PO 00000 Frm 00078 Fmt 4703 Sfmt 4703 E:\FR\FM\03OCN1.SGM 03OCN1

Federal Register / Vol. 83, No. 192 / Wednesday, October 3, 2018 / Notices 49983 Employment (April 17, 1953); Executive Information derived from these record rule, or order that was or may have been Order 12444; Executive Order 10865, sources may include full name; former violated; Safeguarding Classified Information names/aliases; date and place of birth; (4) To a Federal, State, or local agency within Industry (Jan. 7, 1961); Executive social security number; hair and eye maintaining civil, criminal, or other Order 12829, National Industrial color; ethnicity and race; gender; relevant enforcement information or Security Program (Jan. 6, 1993); biometric data; mother’s maiden name; other pertinent information, such as Executive Order 12968, Access to current and former home and work current licenses, if necessary for DOT to Classified Information (Aug. 2, 1995); addresses, phone numbers, and email obtain information relevant to a DOT Executive Order 13567, Reforming addresses; employment history; military decision concerning the hiring or Processes Related to Suitability for history; education history; criminal retention or an employee, the issuance Government Employment, Fitness for history; court actions; credit reports; of a security clearance, the letting of a Contractor Employees, and Eligibility financial information, including contract, or the issuance of a license, for Access to Classified National financial disclosure filings; personnel grant or other benefit; Security Information (June 30, 2008); security adjudications and eligibility (5) To a Federal agency, upon its Executive Order 13488, Granting decisions; spouse, cohabitant, or relative request, in connection with the Reciprocity on Excepted Service and names, dates and places of birth, social requesting Federal agency’s hiring or Federal Contractor Employee Fitness security numbers, and citizenship retention of an employee, the issuance and Reinvestigating Individuals in information; foreign contacts and of a security clearance, the reporting of Positions of Public Trust (Jan. 16, 2009); activities; travel records or briefings; an investigation or an employee, the Executive Order 13526, Classified polygraph examination reports; letting of a contract, or the issuance of National Security Information (Jan. 5, document control registries; facility a license, grant, or other benefit by the 2010); Executive Order 13587, access records; security violation files; requesting agency, to the extent that the Structural Reforms to Improve the and requests for access to classified information requested is relevant and Security of Classified Networks and the information. This system also includes necessary to the requesting agency’s Responsible Sharing and Safeguarding reports of indicia of potential insider decision on the matter; (6) To the Department of Justice, or of Classified Information (Oct. 7, 2011); threats and counterintelligence referrals, any other Federal agency conducting 49 U.S.C. 40113, 49 U.S.C. 44701(a)(5). insider threat inquiry reports, and litigation, when (a) DOT, (b) any DOT referrals to law enforcement. PURPOSE(S) OF THE SYSTEM: employee, in his/her official capacity, or The purpose of this system is to RECORD SOURCE CATEGORIES: in his/her individual capacity if the receive and respond to reports of Records are obtained from existing Department of Justice has agreed to potential insider threats, manage and DOT record systems, publicly-available represent the employee, or (c) the track insider threat inquiries and law sources, Federal agencies, DOT United States or any agency thereof, is enforcement referrals, and identify employees, or individuals who are the a party to litigation or has an interest in potential insider threats to DOT subject of such records. litigation, and DOT determines that the information assets. use of the records by the Department of ROUTINE USES OF RECORDS MAINTAINED IN THE Justice or other Federal agency CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM, INCLUDING CATEGORIES OF USERS AND conducting the litigation is relevant and SYSTEM: THE PURPOSES OF SUCH USES: necessary to the litigation; provided, Current and former DOT employees, In addition to those disclosures however, that DOT determines, in each including contractors, subcontractors, generally permitted under 5 U.S.C. case, that disclosure of the records in experts, consultants, licensees, 552a(b) of the Privacy Act, all or a the litigation is a use of the information certificate holders, grantees, interns, portion of the records or information contained in the records that is students, or any other category of person contained in this system may be compatible with the purpose for which who acts on behalf of DOT and has disclosed outside DOT as a routine use the records where collected. authorized access to classified or pursuant to 5 U.S.C. 552a(b)(3): (7) To parties in proceedings before controlled unclassified information, as (1) To third parties only to the extent any court or adjudicative or determined by the Secretary of necessary and relevant to a DOT or FAA administrative body before which DOT Transportation or Administrator of the insider threat inquiry; appears when (a) DOT, (b) any DOT Federal Aviation Administration. (2) To any Federal agency with employee in his or her official capacity, responsibilities for activities related to or in his or her individual capacity CATEGORIES OF RECORDS IN THE SYSTEM: where DOT has agreed to represent the counterintelligence or the detection of Categories of records in the system insider threats, for the purpose of employee, or (c) the United States or will include reports of indicia of insider conducting such activities; any agency thereof is a party to threat activity, and information relevant litigation or has an interest in the and necessary to DOT’s evaluation of DOT General Routine Uses proceeding, and DOT determined that is those reports and the conduct of an (3) To the appropriate agency, relevant and necessary to the insider threat inquiry. These records whether Federal, State, local, or foreign, proceeding; provided, however, that may include information obtained from charged with the responsibility of DOT determines, in each case, that DOT Operating Administrations, other implementing, investigating, disclosure of the records in the Federal agencies, or publicly available prosecuting, or enforcing a statute, proceeding is a use of the information sources, including, but not limited to, regulation, rule or order, when a record contained in the records that is daltland on DSKBBV9HB2PROD with NOTICES personnel security records, in this system indicates a violation or compatible with the purpose for which administrative adjudication records, potential violation of law, whether civil, the records where collected. regulatory records, incident reports, criminal, or regulatory in nature, (8) To the Office of Management and personnel records, network or building including any records from this system Budget (OMB) in connection with the access records, identification media relevant to the implementation, review of privacy relief legislation as set records, law enforcement records, investigation, prosecution, or forth in OMB Circular A–19 at any stage financial records, and travel records. enforcement of the statute, regulation, of the legislative coordination and VerDate Sep<11>2014 18:05 Oct 02, 2018 Jkt 247001 PO 00000 Frm 00079 Fmt 4703 Sfmt 4703 E:\FR\FM\03OCN1.SGM 03OCN1

49984 Federal Register / Vol. 83, No. 192 / Wednesday, October 3, 2018 / Notices clearance process set forth in that function related to this system of ADMINISTRATIVE, TECHNICAL, AND PHYSICAL Circular. records. SAFEGUARDS: (9) To the National Archives and (15) To an agency, organization, or Records in this system are Records Administration for an individual for the purpose of performing safeguarded in accordance with inspection under 44 U.S.C. 2904 and an audit or oversight related to this applicable rules and policies, including 2906. system or records, provided that DOT all applicable DOT automated systems (10) To another agency or determines the records are necessary security and access policies. Strict instrumentality of any government and relevant to the audit or oversight controls have been imposed to minimize jurisdiction for use in law enforcement activity. This routine use does not apply the risk of compromising the activities, either civil or criminal, or to to intra-agency sharing authorized information that is being stored. Access expose fraudulent claims; however, this under Section (b)(1) of the Privacy Act. to records in this system is limited to routine use only permits the disclosure (16) To a Federal, State, local, tribal, those individuals who have a need to of names pursuant to a computer foreign government, or multinational know the information for the matching program that otherwise agency, either in response to a request performance of their official duties and complies with the requirements of the or upon DOT’s initiative, terrorism who have appropriate clearances or Privacy Act. information (6 U.S.C. 485(a)(5), permissions. (11) To the Attorney General of the homeland security information (6 U.S.C. RECORD ACCESS PROCEDURES: United States, or his/her designee, 482(f)(1), or law enforcement information indicating that a person information (Guideline 2, report Individual seeking access to records meets any of the disqualifications for attached to White House Memorandum, in this system of records should follow receipt, possession, shipment, or ‘‘Information Sharing Environment,’’ the procedures described in the section transport of a firearm under the Brady Nov. 22, 2006), when DOT finds that ‘‘Notification procedure’’ below. Handgun Violence Prevention Act. In disclosure of the record is necessary and CONTESTING RECORD PROCEDURES: case of a dispute concerning the validity relevant to detect, prevent, disrupt, Individuals seeking amendment to the of the information provided by DOT to preempt, or mitigate the effects of records in this system of records should the Attorney General (or designee), it terrorist activities against the territory, follow the procedures described in the shall be a routine use of the information people, and interests of the United section ‘‘Notification procedure’’ below. in this system to make any disclosures States, as contemplated by the of such information to the National Intelligence Reform and Terrorism NOTIFICATION PROCEDURES: Background Check System, established Prevention Act of 2004, Public Law The Secretary of Transportation has by the Brady Handgun Violence 108–456, and Executive Order 13388 exempted this system from the Prevention Act, as may be necessary to (Oct. 25, 2005). notification, access, and amendment resolve such dispute. procedures of the Privacy Act because it DISCLOSURE TO CONSUMER REPORTING (12) To appropriate agencies, entities, may contain classified information, and AGENCIES: and persons, when (1) DOT suspects or includes allegations and inquiries about has confirmed that the security or None. potential unauthorized disclosure of confidentiality of information in the POLICIES AND PRACTICES FOR STORAGE OF classified or controlled unclassified system of records has been RECORDS: information in violation of federal law. compromised; (2) DOT has determined However, DOT/FAA will consider Records in this system are stored that as a result of the suspected or individual requests to determine electronically and/or on paper in secure confirmed compromise there is a risk of whether or not the information facilities. harm to economic or property interests, requested may be released. Thus, identity theft or fraud, or harm to the POLICIES AND PRACTICES FOR RETREIVEAL OF individuals who seek notification of and security or integrity of this system or RECORDS: access to any record contained in this other systems or programs (whether Records may be retrieved by system, or who seek to contest its maintained by DOT or not) that rely on individual’s name or DOT- or FAA- content, may submit a request for such the compromised information; and (3) assigned case number. information to the DOT or FAA. the disclosure made to such agencies, Individuals seeking access to records in entities, or persons is reasonably POLICIES AND PRACTICES FOR RETENTION AND this system maintained by the DOT necessary to assist in connection with DISPOSAL OF RECORDS: Insider Threat Program should submit a DOT’s efforts to respond to the The records in this system are covered request to the DOT or FAA System suspected or confirmed compromise by National Archives and Records Manager identified at the address listed and prevent, minimize, or remedy such Administration Schedule 5.6, items 230 under ‘‘System Manager and Address,’’ harm. and 240. Records determined to be above. (13) To the Office of Government associated with an insider threat or to When seeking records about yourself Information Services (OGIS) for the have potential to be associated with an from this system of records or any other purpose of resolving disputes between insider threat are destroyed 25 years Departmental system of records your requesters seeking information under after the date the threat was discovered, request must conform with the Privacy the Freedom of Information Act (FOIA) but a longer retention is authorized if Act regulations set forth in 49 CFR part and DOT, or OGIS’ review of DOT’s required for business use. User 10. You must sign your request, and policies, procedures, and compliance attributed data collected to monitor user your signature must either be notarized daltland on DSKBBV9HB2PROD with NOTICES with FOIA. activities on a network to enable insider or submitted under 28 U.S.C. 1746, a (14) To DOT’s contractors and their threat programs and activities to support law that permits statements to be made agents, DOT’s experts, consultants, and authorized inquiries and investigations, under penalty of perjury as a substitute others performing or working on a is destroyed five years after an inquiry for notarization. If your request is contract, service, cooperative agreement, was opened, but a longer retention seeking records pertaining to another or other assignment for DOT, when period is authorized if required for living individual, you must include a necessary to accomplish an agency business use. statement from that individual VerDate Sep<11>2014 18:05 Oct 02, 2018 Jkt 247001 PO 00000 Frm 00080 Fmt 4703 Sfmt 4703 E:\FR\FM\03OCN1.SGM 03OCN1

Federal Register / Vol. 83, No. 192 / Wednesday, October 3, 2018 / Notices 49985 certifying his/her agreement for you to from the following provisions of the HISTORY access his/her records. Privacy Act pursuant to 5 U.S.C. This is a new system of records. 552a(k)(1) and (k)(2): (c)(3), (d), (e)(1), EXEMPTIONS CLAIMED FOR THE SYSTEM: Claire W. Barrett, (e)(4)(G)–(I), and (f). This system contains classified and Departmental Chief Privacy Officer. unclassified records that are exempt [FR Doc. 2018–21441 Filed 10–2–18; 8:45 am] BILLING CODE P daltland on DSKBBV9HB2PROD with NOTICES VerDate Sep<11>2014 18:05 Oct 02, 2018 Jkt 247001 PO 00000 Frm 00081 Fmt 4703 Sfmt 9990 E:\FR\FM\03OCN1.SGM 03OCN1


Document Created: 2018-10-03 02:29:43
Document Modified: 2018-10-03 02:29:43
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
ActionNotice of Privacy Act system of records.
DatesWritten comments should be submitted on or before November 2, 2018 The Department may publish an amended SORN in light of any comments received. This new system will take effect November 2, 2018.
ContactFor questions, please contact: Claire W. Barrett, Departmental Chief Privacy Officer, Privacy Office, Department of Transportation, Washington, DC 20590; [email protected]; or (202) 366-8135.
FR Citation83 FR 49981 
2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR