DHS Privacy Impact Assessment Publication Change

DHS published a notice in today’s Federal Register (78 FR 12337-12343) announcing a change in the availability status of 38 Privacy Impact Assessments (PIA) that were published between June 1^st and November 30^th, 2012. Those PIAs are currently published on various Department web sites, but after April 23, 2013, they will only be available upon request from the issuing agency.

PIAs of Interest

These PIAs are required by government regulation because the Department collects, stores and uses personally identifiable information (PII) in the supported programs and the PIAs outline the steps the Department takes to protect that information. Four of the programs listed in this notice may be of specific interest to readers of this blog; they are [Note: links are to the description of the PIA in this notice]:

• DHS/OPS/PIA-008 Homeland Security Information Network R3 User Accounts (HSIN);

• DHS/OPS/PIA-007 Homeland Security Information Network 3.0 Shared Spaces;

• DHS/NPPD/PIA-009 Chemical Facility Anti-Terrorism Standards (CFATS);

• DHS/USCG/PIA-001(b) Homeport Internet Portal.

There is no centralized location for finding these PIA’s on the DHS web site. Each organization maintaining PIAs has a separate web site where the current links can be found to the actual PIA. The above listed PIAs can be found at the listed links:

• HSIN R3 User Accounts;

• HSIN 3.0 Shared Spaces;

• CFATS

• Homeport

According to the Office of Operations Coordination and Planning web site the HSIN 3.0 Shared Spaces PIA was updated in January of this year. I suppose that the updated PIA is not going to be removed from the site this April.

Interestingly the NPPD , the  Office of Operations Coordination and Planning, and the Coast Guard PIA web sites all provide links to a number of PIAs that predate the June 1^st, 2012 start of the period covered by this notice. Why the particular PIAs listed in this notice will be removed from the web site and not the earlier ones is not clear.

Why?

Actually, the whole purpose of removing the PIAs from the DHS web site is not clear. In fact, it appears to me to be counterproductive to the whole PIA process. PIAs are produced to ensure, and document for the public, that PII collected by the government is collected for legitimate purposes and is appropriately protected by the collecting agencies. Making these documents less available inevitably leads to questions of the need for collecting the data and the viability of the measures to protect that data.

This is especially confusing since no reason or justification is provided for the action.

DHS Privacy Impact Assessments

On Wednesday DHS published a notice in the Federal Register about a number of Privacy Impact Assessments (PIA) that were approved by DHS Privacy Office last spring. Of the twelve PIA listed in the notice two deal with the CFATS system. All of the PIA will be available on the DHS Privacy web site until December 14th. After that they will be available upon request to the privacy office (pia@dhs.gov). The two CSAT PIA are currently listed on the DHS Counterterrorism Laws and Regulations web page. There are a number of links on that page and it might be difficult to find the PIA links. The specific links are provided in the brief discussions below. The first of the CSAT PIA was designed to update the CSAT PIA for the addition of the Site Security Plan and the increased number of personnel that were authorized to be Preparers for that document. Additionally, the ‘new’ CSAT Tip Line was included as the Help Desk would be asking for voluntary submission of personal identification information (PII) when people made reports on the Tip Line. This PIA was approved June 5th. The second CSAT PIA was added to reflect the collection of PII from government employees and contractors to authorize their use of the CHEMS system. This is an internal DHS system that extracts facility contact information from CSAT and provides it to authorized government employees and contractors working on chemical facility security issues. CHEMS also allows these people to verify CVI status. This PIA was approved June 11th. Both of these PIA provide detailed information about how a variety of personal information collected by the CFATS program through the CSAT tool is used and protected by DHS. Everyone who has provided personal identification information through CSAT owes it to their own peace of mind to review these documents.