Global Justice Information Sharing Initiative (Global)

Advisory Committee (GAC)

# DRAFT Meeting Minutes

# *Arlington, VirginiaApril 26, 2006*

# 

**Convening and Introductions**

Operating under the guidance and support of the Bureau of Justice
Assistance (BJA), Office of Justice Programs (OJP),[^1] U.S. Department
of Justice (DOJ or "Department"), the Global Justice Information Sharing
Initiative[^2] (Global or "Initiative") Advisory Committee (GAC or
"Committee") spring 2006 meeting was convened by Chairman Kenneth
Bouche.

This summary covers events[^3] of the April 26, 2006, meeting held at
the Sheraton Crystal City Hotel, 1800 Jefferson Davis Highway,
Arlington, Virginia. The proceedings took place over the course of one
day, from 8:30 a.m. to\
3:30 p.m. In the interest of document structure and report
comprehensibility, the order of events described herein does not
necessarily mirror the agenda order. However, the ***content*** is
reflective of meeting activities and resolutions.

Chairman Bouche, GAC member representing SEARCH, The National Consortium
for Justice Information and Statistics (SEARCH), invited participants to
introduce themselves. GAC members and proxies in attendance are listed
below (for a complete roster, including federal partners, invited
guests, and staff, please submit requests to Global support staff at
\[850\] 385-0600, extension 285).

GAC members and proxies in attendance

[]{.mark}

> Robert Boehmer
>
> *National Criminal Justice Association*
>
> *Chicago, Illinois*
>
> Kenneth Bouche
>
> *SEARCH, The National Consortium for Justice Information and
> Statistics*
>
> *Springfield, Illinois*
>
> Kenneth Brisbin\
> (proxy for Thomas Lipps)
>
> *National Council of Juvenile and Family Court Judges*
>
> *Cincinnati, Ohio*
>
> David Byers
>
> *Administrative Office of the Courts*
>
> *Phoenix, Arizona*
>
> William Casey
>
> *Criminal Justice Information Services Advisory Policy Board*
>
> *Boston, Massachusetts*
>
> Thomas Clarke
>
> *National Center for State Courts*
>
> *Williamsburg, Virginia*
>
> Steven Correll
>
> *Nlets---The International Justice and Public Safety Information
> Sharing Network*
>
> *Phoenix, Arizona*
>
> Michael DiLauro
>
> (proxy for Barbara Hurst)
>
> *National Legal Aid and Defender Association*
>
> *Providence, Rhode Island*

Michael Duffy

*Justice Mangement Division -- DOJ*

*Washington, DC*

Jay Emler

*National Conference of State Legislatures*

*Topeka, Kansas*

Paul Fitzgerald

*National Sheriffs\' Association*

*Nevada, Iowa*

Philippe Guiot

> (proxy for Linda Lewis-Pickett)

*American Association of Motor Vehicle Administrators*

*Arlington, Virginia*

Kelly Harris

*SEARCH, The National Consortium for Justice Information and Statistics*

*Sacramento, California*

Vance Hitch

*U.S. Department of Justice*

*Washington, DC*

Bart Johnson

*International Association of Chiefs of Police ---Division of State and
Provincial Police*

*Albany, New York*

Erin Lee

*National Governors Association*

*Washingotn, DC*

Matthew Mangino

*National District Attorneys Association*

*Alexandria, VA*

Harlin McEwen

*International Association of Chiefs of Police*

*Ithaca, New York*

Matthew Miszewski

*National Association of State Chief Information Officers*

*Milwaukee, Wisconsin*

Michael Muth

*INTERPOL---State and Local Liaison Division*

*Washington, DC*

Thomas O'Reilly

*National Association of Attorneys General*

*Trenton, New Jersey*

Jerome Pender

*Federal Bureau of Investigation - CJIS Division*

*Clarksburg, West Virginia*

Russell Porter

(Proxy for Joseph Polisar)

*Criminal Intelligence Coordinating Council*

*Des Moines, Iowa*

Charles Ramsey

*Major Cities Chiefs Association*

*Washington, DC*

Edward Reina

*International Association of Chiefs of Police*

*Sells, Arizona*

Martin Smith

*U.S. Department of Homeland Security*

*Washington, DC*

Richelle Uecker

*National Association for Court Management*

*Santa Ana, California*

Jeffrey Washington

*American Correctional Association*

*Lanham, Maryland*

Carl Wicklund

*American Probation and Parole Association*

*Lexington, Kentucky*

> []{.mark}

Chairman Bouche especially welcomed GAC representatives new to the
Committee since the fall 2005 meeting:

-   The Honorable **Jay Emler**, Senator, Kansas Legislature,
    representing the **National Conference of State Legislatures**.

-   Sheriff **Paul Fitzgerald**, Story County Sheriff\'s Office,
    representing the **National Sheriffs' Association**.

-   Mr. **Matthew Mangino**, representing the **National District
    Attorneys Association**.

-   Mr. **Matthew Miszewski**, Wisconsin Chief Information Officer
    (CIO), representing the **National Association of State Chief
    Information Officers**.

-   Also, DOJ CIO **Vance Hitch** will now **represent the Department on
    both the GAC and Global Executive Steering Committee** (GESC),
    filling a vacant at-large GESC seat.

**Welcoming Addresses**

***Federal Officials' Remarks***

Chairman Bouche introduced the following federal officials and invited
their opening remarks:

**Domingo Herraiz, Director, Bureau of Justice Assistance (BJA),**
emphasized Global's positive impact on the larger justice-interested
community, such as facilitation of partnership building across GAC
member agencies *as well as* federal departments. This is evidenced by
recent collaborations between DOJ, the U.S. Department of Homeland
Security (DHS), and Office of the Director of National Intelligence
(ODNI) on intelligence sharing matters and the National Information
Exchange Model (NIEM), discussed later in the meeting. He stressed the
need to continue defining the Initiative and complementary information
technology (IT) activities in terms of increasing public safety and
immediately understandable values like saving lives, thereby putting a
"face" on Global efforts. Director Herraiz emphasized OJP's commitment
to Global, particularly underscored by OJP Assistant Attorney General
(AAG)\
Regina Schofield's determination that the Initiative remain a high
priority on her list for additional/designated resource allocation. He
relayed AAG Schofield's excitement about Global's spirit of cooperation
as it translates to various federal agencies and noted "she is thrilled
about the idea that state and locals are the driving force behind this
(Global Initiative), and that is logical, because the purpose of the
Office of Justice Programs is \[to support\] state and locals . . . ."
Director Herraiz briefed attendees on several BJA/OJP initiatives that
impact or complement Global efforts, including:

-   **Statewide Automated Victim Information and Notification Program**,
    in partnership with the Office for Victims of Crime, with an eye
    toward linking states' victim information systems using the Global
    Justice XML Data Model (GJXDM), thereby creating a national
    resource.

-   Exploration of **pandemics** issues and implications for local,
    state, and tribal agencies and activities, including justice-related
    information sharing.

-   **Project Safe Neighborhoods (PSN)**,[^4] a nationwide commitment to
    reduce gun crime by networking existing local programs that target
    gun crime and providing these programs with additional tools for
    success. PSN funding is being used to hire new state and federal
    prosecutors, support investigators, provide training, distribute gun
    lock safety kits, deter juvenile gun crime, and develop and promote
    community outreach efforts, as well as to support other gun violence
    reduction strategies. An anti-gang component has been added to PSN
    through the dedication of approximately \$30 million in grant
    support; these monies will facilitate anti-gang enforcement and
    prevention efforts and provide training and technical assistance.
    Director Herraiz noted, "It's a wonderful piece \[to addressing gang
    issues\], but as you all know in this business, it's just as
    important to share gang-related criminal intelligence information.
    We see this as an opportunity to continue to promote the Global
    piece \[as a complement to\] . . . . the PSN gang initiative."

Director Herraiz concluded by thanking Global members for their
continued dedication to the Initiative and GAC leaders for their
tireless dedication to moving the Committee forward. He noted, "My job
at BJA is very simple: it's to connect the dots and identify where
there's overlap \[to leverage existing resources and expertise\], and to
listen to the talent that each of you individually and \[the GAC\]
collectively brings to bear on these issues . . . . Frankly, Global is
working better now than I've seen in the past three years . . . . "

**John Morgan, Ph.D., Assistant Director, National Institute of Justice,
(NIJ),** congratulated Global for successfully pushing information
sharing issues to the fore of national discussion. This accomplishment
was underscored during Dr. Morgan's testimony at a recent congressional
hearing on wireless interoperability, a topic he characterized as an
"extraordinarily difficult problem overlapping with the information
sharing arena." He stated, "It was really a pleasure, first of all, to
see an issue discussed that---ten years ago---was hard to get anybody on
the federal level \[to address\]. Many of the state and local people
were well aware of these interoperability problems, but it was very hard
to get federal people interested in wireless interoperability. And now,
we have a congressional committee running a set of hearings on wireless
interoperability and recognizing the importance of information sharing
within that context."\
Dr. Morgan highlighted NIJ's pursuit of biometrics research and
development (e.g., palm print databases) related to combating identity
theft and, of particular interest to the Global members, the
technology's implications for positive identification and information
sharing security. He concluded by stressing collaboration as integral to
the Initiative's goals: "We need to be willing, in every instance, to be
transparent and honest with each other, able to share all the
information that we have about these topics, and work together as if
there were no boundaries. We come from different perspectives, but that
doesn't mean we can't work together in a professional and collegial
atmosphere, respecting each other's perspectives, abilities, and roles.
I am very encouraged, because I know that spirit is at the very heart of
Global."

**Regina Schofield, Assistant Attorney General (AAG), Office of Justice
Programs (OJP),** expressed her appreciation to Committee members for
their ongoing commitment to the Global Initiative. She focused her
remarks around the theme of Global successes, including OJP's leveraging
of the GJXDM to develop the National Sex Offender Public Registry (NSOPR
or "Registry").[^5] (Director Herraiz demonstrated this resource at the
fall 2005 GAC meeting.) Recently, the Registry received high marks from
government and industry. On February 15, the NSOPR was recognized with
an Excellence.Gov Award from the American Council for Technology (ACT)
and the Industry Advisory Council (IAC). The award recognized 20
government initiatives highly successful in meeting critical information
sharing objectives through collaboration and cutting-edge practices. A
panel of 23 government and industry judges selected finalists from more
than 80 entries, evaluating each on the effectiveness of accomplishing
project objectives, business process and service improvement,
effectiveness and degree of collaboration across organizations, and
industry and government best practices and standards for information
sharing. Not only was NSOPR selected as one of the 20 finalists, it was
also recognized as one of the \"Top 5\" projects for the year. AAG
Schofield reiterated sentiments expressed by preceding speakers by
noting the impressive, collaborative quality that the GAC not only
exhibits, but is imbuing throughout the larger justice-interested
community. Promulgation of this cooperation is a success story in
itself, and she commended DHS, ODNI, the Federal Bureau of Investigation
(FBI), industry (through the IJIS Institute), and other powerful allies
for volunteering their voices to the information sharing dialogue. AAG
Schofield thanked her Global leadership team at OJP, including BJA
Director Herraiz, BJA Deputy Director\
Jim Burch, Global Designated Federal Official Patrick McCreary, OJP
Deputy Assistant Attorney General David Haggy, and strong partners at
NIJ, such as\
Dr. Morgan. She concluded with a statement of OJP commitment to the
Global Initiative and to "pushing this effort to the next highest
level." AAG Schofield noted that a recent visit from Ambassador Thomas
McNamara, Program Manager, ODNI, to OJP, in pursuit of local and state
input in his agency's activities. "This is proof that GAC efforts have
not been in vain."

AAG Schofield presented retiring GAC member William B. Simpkins,
representative from the U.S. Drug Enforcement Administration, with a
distinguished service plaque for his dedication to the Global Initiative
and larger justice field.

***Related Questions/Comments:***

Chairman Bouche requested that AAG Schofield elaborate on Global's
relationship to recent federal budget decisions and associated funding
forecasts. AAG Schofield replied that in her experience at the U.S.
Department of Health and Human Services (HHS), advisory committees
actually fared best when integrated into program planning dollars, as
opposed to aiming for inclusion as a budget line item. She noted Deputy
AAG Hagy was working diligently in this area to ensure continuation of
the Global Initiative and reiterated OJP's commitment to the GAC.

**Committee Business**

Chairman Bouche presented the fall 2005 GAC meeting minutes,
(summarizing the October 20 event) for Committee approval. (The document
was distributed in advance for members' review and comment; this GAC
meeting summary review-and-approval process is a standing procedure.)

> **Recommendation:** Mr. Carl Wicklund, representing the American
> Probation and Parole Association, moved to ratify the document without
> change. Mr. Robert Boehmer, representing the National Criminal Justice
> Association (NCJA), seconded. The motion was brought to a vote and
> passed unanimously.
>
> **Action:** The document will be posted[^6] on the Global Web site and
> provided in hard copy format by request.[^7]

**Federal Briefings**

**U.S. DOJ Information Sharing Activities**

DOJ CIO Hitch briefed attendees on the Department's information sharing
programs and efforts. He used a PowerPoint presentation[^8] and
addressed the following topics:

-   The **Law Enforcement Information Sharing Plan (LEISP**), which is
    DOJ's strategy to ensure law enforcement information collected by
    the Department is shared comprehensively and routinely with local,
    state, tribal, and federal law enforcement partners.

> The LEISP contributes to the fulfillment of the *National Criminal
> Intelligence Sharing Plan* (NCISP); contributes to the strengthening
> of the national Information Sharing Environment (ISE)---per
> Intelligence Reform and Terrorist Prevention Act and Presidential
> directives; ensures DOJ IT investments incorporate law enforcement
> information sharing requirements; ensures DOJ information sharing
> efforts support the needs of law enforcement nationwide; protects the
> legal rights and civil liberties of all Americans; incorporates input
> from law enforcement partners;[^9] leverages and coordinates with
> ongoing information sharing efforts such as Global; and promotes the
> concept of "**One DOJ**."
>
> CIO Hitch emphasized that the LEISP is an evolving, dynamic umbrella
> program that covers all aspects associated with information sharing:
> not just technological issues, but also policies, culture change, and
> business practices. He noted the Plan was a way to "get our own
> \[DOJ\] house in order and share information internally as well as
> externally."

-   "**One DOJ,"** a core concept of the LEISP, establishes DOJ-wide
    policies, operations, services, and technical standards; ensures
    consistency of DOJ information to meet the needs of law enforcement
    stakeholders; pursues standardization across the various
    DOJ-affiliated law enforcement agencies;[^10] and provides one entry
    point for DOJ law enforcement information, regardless of where the
    information resides.

-   CIO Hitch discussed **two complementary tools/systems to the
    LEISP**:

    -   **R-DEx** (Regional Data Exchange), was created to address DOJ's
        interface with regional intelligence centers that have developed
        and are developing across the nation. These regional systems are
        grant-funded and locally hosted and maintained, adhere to
        national standards, and implement a standard interface,
        facilitating access to DOJ data. R-DEx is a reality and has been
        implemented in a pilot with the Law Enforcement Information
        Exchange (LInX) system in the northwest.[^11]

    -   **N-DEx** (National Data Exchange) will be the card catalogue
        telling users what incident-level information structured data is
        available within DOJ and law enforcement agencies across the
        United States. N-DEx is federally funded; federally hosted and
        maintained (through the FBI Criminal Justice Information
        Services \[CJIS\] Division); and provides multiagency (local,
        state, and federal) data to the authorized user. N-DEx is in the
        beginning development stages and will be rolled out over the
        next several years. While R-DEx addressed regional centers and
        major population areas,\
        N-DEx will cover all of the grey space in between. Ultimately,
        when both systems are available, they will appear as a single
        system.

-   **NIEM**[^12] (National Information Exchange Model) is an
    interagency initiative based on the GJXDM, providing the building
    blocks for national-level interoperable information sharing and data
    exchange. The NIEM project was initiated as a joint venture between
    DOJ and DHS, with outreach to other departments and agencies. NIEM
    is a federated architecture for data standards for information
    exchange, presenting a framework for interconnecting independent
    communities of interest. Key data concepts are divided into levels
    of applicability to participants and include Universal Core
    (applicable to all participating domains), Common Core, and Domain
    Specific.

-   Other DOJ information sharing activities include:

    -   Creation of a National Gang Intelligence Center to coordinate
        the national collection and sharing of gang intelligence;

    -   The next generation of the Integrated Automated Fingerprint
        Identification System (IAFIS);

    -   DOJ Litigation Case Management System; and

    -   The Integrated Wireless Network, a multiphase project in
        conjunction with DHS and the U.S. Department of Treasury aimed
        at enhancing federal law enforcement wireless capabilities
        across the country.

CIO Hitch concluded by recognizing key LEISP contributors DOJ Chief
Privacy Officer Jane Horvath and Deputy Program Manager Sue Reingold,
Information Sharing Environment (ISE), Office of the Director of
National Intelligence (ODNI). He also commended Michael Duffy,
longstanding GAC participant, for his role in involving Global members
in the development and refinement of the LEISP from the earliest stages.

***Related Questions/Comments:***

A Global member asked if the LEISP will involve information sharing with
justice entities other than law enforcement. CIO Hitch affirmed that
"while the systems that gather information and drive it \[the LEISP\]
are coming from law enforcement, our *sharing* aspects will reach beyond
that specific community."

**Information Sharing Environment (ISE), ODNI**

Chairman Bouche introduced ISE Deputy Program Manager Sue Reingold and
commended her assistance in forging a strong relationship between GAC
and the Homeland Security Council, Global's counterpart at DHS.

Director Reingold began by briefing attendees on the role of the ISE
Program Manager, created when the President signed the Intelligence
Reform and Terrorism Prevention Act. The Act requires the implementation
of an information sharing environment to facilitate government-wide
(local, state, tribal, and federal agencies, as well as private
industry) sharing of terrorist threat information. Based on a key
recommendation of the 9/11 Commission, the ISE concept includes an
ambitious and coordinated effort by a number of agencies. Important
mandates related to the ISE require the Program Manager to 1) address
key technological and policy issues, 2) complete a review of the federal
government\'s data sharing capabilities, and 3) establish an electronic
directory service to help locate terrorist threat information. The ISE
Program Manager,\--Ambassador Thomas McNamara---resides in ODNI and is,
as Director Reingold noted, "in, but not of, the DNI. The authorities
and scope of the Program Manager actually go beyond the DNI. Our role
and mission is to help create and implement a *national* strategy." The
Act also created the Information Sharing Council (Council), which
provides advice and assistance regarding the establishment,
implementation, and maintenance of the ISE. The Council is in the
process of establishing two subcommittees---*private industry* and
*local, state, and tribal---*to elicit these specific communities' input
and expertise. The local, state, and tribal subcommittee is drawing
membership from the GAC and HSAC advisory committees to harvest those
constituencies' perspectives.

Director Reingold discussed two priority ISE areas: sensitive but
unclassified (SBU) information and integration of local, state, and
tribal efforts with federal government activities. "These need to happen
from both top-down and bottom-up perspectives. We \[the federal
government\] need to come up with a consolidated approach in how we work
with the state and local environment, but then also at the state and
local level, it is important that . . . . state and locals support the
involvement of federal partners in fusion center efforts, so we can all
work together more smoothly." These two issues (SBU and integration
efforts) will be prioritized in the ISE implementation plan, which is
due to the President in July. Global members were assured they would be
involved in the review of the plan as it develops.

The ISE is also concerned with suspicious activity reports (SAR), and to
that end, the next day the Program Office was convening their local,
state, and tribal subcommittee along with key federal representatives
from DOJ, DHS, the FBI, the Central Intelligence Agency (CIA), the U.S.
Department of Defense (DOD), and the National Counter-Terrorism Center
(NCTC) to address the issue. The purpose of the meeting will be to
solicit input directly from local, state, and tribal authorities
regarding best practices, lessons learned, and requirements relating to
two specific terrorism information sharing challenges:

-   Coordinating threat reporting and response between the federal
    counterterrorism community and local, state, and tribal governments.

-   Streamlining reporting of suspicious activities and/or incidents
    potentially relevant to terrorism.

The goal of this meeting will be the development of recommendations to
be incorporated into the ISE implementation plan.

To technologically facilitate sharing across communities, the Program
Office is recommending adoption and endorsement of the NIEM standards as
the ISE data standards. The Program Office is also exploring the
Controlled Access Program Coordination Office (CAPCO) standards for
intelligence sharing. The ISE architectural efforts are being pursued in
line with the required, established federal enterprise architecture.

Deputy Director Reingold noted a final area of emphasis is an ISE
electronic directory of services (EDS)[^13] within a classified
environment---something that has never existed. The approach to EDS is
incremental, starting at the federal level to provide directory services
information within a classified environment. Eventually, the capability
will be extended to the SBU level, and Global can assist in developing
that tier of the system as well as identifying data for inclusion. The
first iteration of the EDS, released at the end of March, provides
contact information for counterterrorism-related watch centers and is
similar to the telephone book's blue pages listing. These blue pages are
available to anyone with access to sensitive compartmented information
(SCI) and SECRET security domains. The blue pages reflect agreements and
cooperation among Council members and are hosted by ODNI (blues pages in
the SCI security domains) and DHS (blue pages in the SECRET domain).

Chairman Bouche thanked Director Reingold and noted that the Global SAR
document she referenced had been drafted primarily by GAC member Colonel
Bart Johnson, representing the International Association of Chiefs of
Police (IACP)---Division of State and Provincial Police, and Mr. Russell
Porter, Global's Criminal Intelligence Coordinating Council vice chair.
These gentlemen were commended for their work.

**National Information Exchange Model (NIEM) Governance Structure**

Mr. Paul Embley, chairman of the Global XML Structure Task Force
(XSTF)---the body responsible for the development, evolution, and
maintenance of the Global JXDM,---and Mr. Kshemendra Paul, NIEM Chief
Enterprise Architect and Program Manager, provided the NIEM briefing.
The presentation focused on NEIM developments since the last GAC
meeting. A key occurrence has been the appointment of Mr. Paul to his
leadership position in the NIEM effort, a staffing decision that
Chairman Bouche strongly endorsed as helpful in both advancing the
project and including Global perspectives in the project.

Mr. Embley and Mr. Paul used a PowerPoint presentation[^14] and
addressed the following topics:

[]{.mark}

-   Vision for NIEM

-   Goals and objectives

-   NIEM defined in context

-   Benefits of NIEM

-   Governance

    -   Organization model

    -   Roles and responsibilities

    -   Target concept of operations

-   Upcoming milestones

-   Local/state/tribal involvement

-   Risks

[]{.mark}

> Two areas of NIEM that will especially benefit from Global
> participation are:

1.  Participation on NIEM groups by Global members or their designees
    (e.g., an agency executive's lead IT staff member) in a number of
    capacities, from policy- and governance-focused involvement on the
    executive level groups to technical participation on the
    development-oriented teams.

> **Request for Global member action:** Interested parties can express
> willingness to volunteer for the NIEM effort by contacting Global
> staff at <drinehart@iir.com> or (850) 385-0600, extension 285.

2.  Development of an elevator speech or quick-pitch/executive-level
    briefing promoting GJXDM/NIEM to policymakers. Comments by GAC
    members during the ensuing discussion will help inform next steps
    related to this task and included the following:

    a.  **Stress that GJXDM and NIEM are [business-driven]{.underline}
        in their development, and are concerned with end results.** When
        fully implemented, this means: "This helps us catch bad guys
        better." The *how* (or technical explanations) should be
        targeted only to IT people.

    b.  **Take out the IT jargon, representations, and models.**
        Referencing the briefing's PowerPoint slides, CIO Miszewski
        commented: "Don't use the stack and EA architecture \[in your
        presentation\], because when you say 'data model' to
        policymakers, you're done." Another "sticking point" in briefing
        delivery is *Information Exchange Package Documentation*
        (**IEPD**). As one attendee noted, "The acronym alone loses
        people." Instead, this concept should be couched in business
        terms that a policymaker or justice executive understands
        without the need for prolonged exposition, background, and
        analogy. "Use real world examples like a rap sheet, and attach
        the IEPD term at the end of the discussion (if you must), but
        not at the beginning.\"

    c.  **Put a face on the Global JXDM/NIEM efforts---Make the pitch
        *count.*** For example: September 11 terrorist Mohammad Atta was
        pulled over for a traffic violation prior to his involvement in
        the attacks. If information had been shared more effectively, he
        may very well have been detained by law enforcement, possibly
        interrupting subsequent plans.

    d.  **Coordinate with GAC member agency SEARCH, The Consortium for
        Justice Information and Statistics.** SEARCH Deputy Director
        Kelly Harris, who sits at the GAC table as the organization's
        advocate, has already initiated executive briefing development
        efforts. Global representatives, members of the Global JXDM
        Training and Technical Assistance Committee (GTTAC), and support
        staff should work in concert with SEARCH to leverage resources,
        ideas, and SEARCH's work already accomplished in this area.

    e.  Other concepts for consideration in longer executive briefings
        include:

        1.  NIEM is a voluntary standard.

        2.  NIEM stresses responsiveness to users' feedback during
            testing phases. As Mr. Paul noted, "This is a process, not a
            terminal release."

> **Action item**: Working in conjunction with SEARCH and GTTAC, Global
> will convene a focus group to develop and refine the NIEM "Elevator
> Pitch"/15-Minute Executive Briefing. The results of this effort will
> be part of the fall 2006 GAC meeting agenda, to include a training
> session for GAC members on understanding the NIEM concepts and
> successfully delivering the 15-minute pitch. This will include
> discussion of migration from GJXDM to NIEM, and the relationship
> between the two efforts.

***Related Questions/Comments:***

Ms. Richelle Uecker, GAC member representing the National Association
for Court Management and chair of the Global Security Working Group
(GSWG), underscored the need for a well-articulated, formalized
GJXDM/NIEM transition strategy in advance of the convergence of the
model. Mr. Paul answered that the governance and CONOPS tiger teams are
working on a document examining the technological and policy issues of
the convergence. When completed, the paper will be circulated to a
number of GAC members and other selected justice practitioners for
review and comment.

Chairman Bouche applauded the NIEM team for their responsiveness to
Global concerns expressed at the fall GAC meeting. At that time,
Committee members wanted to ensure Global-related NIEM domains were not
governed in a federally centric manner but, instead, would integrate GAC
resolutions regarding justice domain issues *and* include Global
participation in nonjustice-specific decisions. This issue was briefed,
via Global federal officials and GAC leadership, to appropriate
high-level DOJ policymakers. As a result---and due to the collaborative,
inclusive approach by Mr. Paul---tremendous advances have been made in
the NIEM governance strategy. Cuing off the PowerPoint slide enumerating
the NIEM organizational structure, Chairman Bouche stated, "This chart
is really critical, because this is where we have made huge progress. .
. . Kshemendra has helped put in place the actual governance model that
our Global group has recommended."

**Pandemics---Implications for the Justice Community**[^15]

BJA Deputy Director Jim Burch briefed members on an upcoming
BJA-sponsored Pandemic Symposium, to be held May 24-25, 2006, in\
Chicago, Illinois. He underscored the topic's implications for
justice-related information sharing through the use of a realistic
scenario illustrating how quickly and pervasively such an event could
impact the justice and public safety communities, necessitating
information exchange with crucial but nontraditional partners like
health and human services, agriculture, and education.

> **Request for Global member action:** Global members were asked to add
> their voice to the *pandemics* dialogue by providing feedback to the
> following questions:

-   From your agency's perspective, what pandemic-triggered
    justice-related information sharing questions or issues would you
    like to see addressed at the Symposium?  

-   Regarding pandemic planning and response, are there issues that will
    specifically impact the justice community (for example,
    quarantining) that need to be considered?

Additionally, several GAC members were invited to participate in the BJA
event. More information on this issue, including Symposium outcomes,
will be made available in the future.

**New Global Activity: National Information Sharing Strategy (NISS)**

Cuing off discussions initiated during the fall 2005 GAC meeting
session, "What's Hot in Justice Information Sharing," Global members
have already unanimously agreed that development of an NISS is a natural
evolution of the *National Criminal Intelligence Sharing Plan*
(NCISP).[^16] This position was confirmed by significant GESC
deliberation in January and March and at the February Criminal
Intelligence Coordinating Council (CICC) meeting. As a result of these
discussions, Global leaders submitted a project prospectus to federal
officials.

Pending approval, this activity will be more than a simple rewrite of
the NCISP. Pursuit of an NISS involves leveraging existing systems and
networks (such as fusion centers, Nlets---The International Justice and
Public Safety Information Sharing System, the Regional Information
Sharing Systems \[RISS\], Law Enforcement Online \[LEO), and the
Homeland Security Information Network \[HSIN)) and identifying best
practices to answer questions such as: What types of information do the
systems have? With whom do they communicate and share information?

The proposal for the NISS project includes:

-   Establishment of an ad hoc Global Special Projects Group to
    identify, survey, and catalog applicable information sharing systems
    and networks for use by law enforcement, fusion centers, and other
    information sharing participants. This group will work closely with
    ODNI in support of the ISE.

-   Surveying these centers, systems, and networks to determine how the
    centers operate; types of information they collect; networks and
    systems accessed; and amount and type of interaction with other
    centers, units, task forces, and functions.

-   The ad hoc group will utilize the survey results to develop an
    architecture that describes the current information sharing process,
    best practices and suggestions for improvement, and options to
    alleviate the gaps that exist within the ISE.

-   A map of the systems, networks, and fusion centers will be
    developed, providing a national picture of the systems and networks,
    which centers interface/interact, and any gaps in information
    sharing. Visibility of existing systems was noted as an important
    by-product of this effort.

> **Action:** Next steps in pursuit of the NISS will be formation of the
> ad hoc group and development of a specific action plan.
>
> **Request for Global member action:** Global members interested in
> participating in the NISS group were requested to contact Global staff
> at <drinehart@iir.com> or (850) 385-0600, extension 285.

[]{.mark}

[]{.mark}

**Global Working Group Reports**

Global working group chairs provided updates on their efforts since the
last GAC meeting.

***Global Security Working Group (GSWG)***

**GSWG Chair Uecker** provided the briefing with the assistance of\
Mr. John Ruegg, Los Angeles County Information Systems Advisory Body and
chair of the Global Security Architecture Committee.

The draft document, *Applying Wireless Security Practices to Justice
Information Sharing,* was presented to the Committee*.* This reference
piece is a companion to the earlier released *Applying Security
Practices to Justice Information Sharing* and contains a wireless
overview and wireless guidelines for secure information sharing. Chair
Uecker provided the caveat that the document, while a wonderful
educational resource, is not intended to suggest a standard security
approach nor provide an in-depth security solution for any particular
system.

> **Request for Global member action:** Committee members were asked to
> review the document and provide comments within a specified timeline.
> In addition, to build the strongest resource possible, representatives
> were encouraged to include interested peers in the review process.
> Once finalized, the tool will be available in hard copy and CD format,
> likely in combination with the original *Security Practices* release.

Chairs Uecker and Ruegg briefed attendees on the progress of the Global
Federated Identity and Privilege Management (GFIPM) efforts and related
demonstration project. The presentation included background information
on the effort and emphasized key components of the approach, as follows:

> The GSWG established a subcommittee, the Global Security Architecture
> Committee (GSAC), to develop a security architecture in support of the
> *National Criminal Intelligence Sharing Plan* (NCISP). The plan calls
> for "a technology architecture to provide secure, seamless sharing of
> information among \[intelligence\] systems." The architectural
> approach being pursued by the GSAC is based on a concept of federated
> identity and privilege management (FIPM), and its utility can extend
> beyond the intelligence community.
>
> []{.mark}
>
> A *federation* is a group of two or more trusted partners with
> business and technical agreements that allow a user from one
> federation partner/participating agency to seamlessly access resources
> from another partner in a secure and trustworthy manner. The
> federation provides a standardized means for allowing agencies to
> directly provide services for trusted users that they do not directly
> manage. The identities from one enterprise domain (or *identity
> provider*) are granted access to the services of another enterprise
> (or *service provider*).
>
> []{.mark}
>
> A well-defined set of trusted attributes about locally authenticated
> users are securely exchanged between identity and service providers,
> allowing for identification and fine-grained dissemination decisions
> to be made by each participating agency in accordance with its local
> policies and business practices.
>
> []{.mark}
>
> The federated concept allows effective off-loading of user
> administration costs back to the provider, who has direct
> responsibility for managing the user. The user experience is improved
> because users can navigate easily between Web sites while maintaining
> a global login identity. Integration is simplified because there is a
> common way to network identities between agencies or between
> applications. Organizations can eliminate the debates caused by
> incompatible identity and security management mechanisms. The
> federated model enables service providers to share resources with a
> large base of established users and partners that would normally not
> have access.
>
> []{.mark}
>
> A passport analogy was used to illustrate---in less technical
> terms---how the federated concept works and highlight the benefits.
>
> []{.mark}
>
> At the highest conceptual level within the Global FIPM model, there
> are three vital components that must interact among multiple systems:

-   Identity Provider (IDP)

-   Service Provider (SP)

-   User Profile (Metadata)---which taps into the work and success of
    the GJXDM and NIEM data modeling efforts to leverage and reuse these
    specifications in describing Global FIPM User Profiles

[]{.mark}

> The briefing concluded with a discussion of the DOJ/DHS FIPM
> Demonstration Project as follows:
>
> []{.mark}
>
> The concept of a federation has emerged from the GSAC and has received
> growing interest from several local, state, tribal, regional, and
> federal systems. As a result, a demonstration project has been
> proposed under the cosponsorship of the U.S. Department of Justice
> (DOJ) and the U.S. Department of Homeland Security (DHS). The initial
> phase of this proof of concept will include participation from the
> Criminal Information Sharing Alliance network (CISAnet), Pennsylvania
> Justice Network (JNET), and the Regional Information Sharing Systems®
> secure intranet (RISSNET™). Others expressing interest in
> participating in the demonstration during follow-on phases include the
> California Department of Justice, Wisconsin Department of Justice,
> DHS's HSIN/Joint Regional Information Exchange System (JRIES), and the
> Automated Regional Justice Information System (ARJIS). The data
> requirements and the resultant set of vetted attributes identified
> through this survey process will be operationally validated as part of
> the Global FIPM demonstration project.
>
> []{.mark}
>
> Three distinct use-case scenarios have been identified by the GSAC as
> applicable to information sharing between local, state, regional,
> tribal, and federal agencies:

1.  System-to-system connectivity

2.  User-to-application connectivity

3.  User-to-user/system-to-user messaging

> Although each use-case scenario is pertinent and must eventually be
> addressed, the user-to-application connectivity use-case scenario will
> be the focus of the demonstration project in order to keep the scope
> of the project manageable
>
> []{.mark}
>
> The scope of the demonstration project is to develop and provide an
> identity and privilege management service that can be used to apply
> authentication and access controls by disparate systems and networks
> desiring to make their resources "sharable." The outcome is intended
> to demonstrate a universal mechanism, implementation-independent and
> nonvendor-specific, which is designed to share trusted assertions
> (agreed set of attributes) that can be used to apply authentication
> and access controls

[]{.mark}

The demonstration is limited to:

-   The user-to-computer application use case.

-   Web-based applications only.

-   JNET, CISAnet, and RISSNET to prove the concept.

-   Open source, noncommercial software to keep the software licensing
    costs to a minimum.

[]{.mark}

> The focus of the demonstration project is to 1) achieve a "quick win;"
> 2) capture "lessons learned;" and 3) lay a foundation of experience on
> which participants, stakeholders, and sponsors can assess the value
> and feasibility of a security and information sharing architecture
> based on federated identity and privilege management. The intent is to
> demonstrate a "real-life," multidirectional electronic exchange of SBU
> information, achieved through secure systems interoperability between
> networks/information systems currently not capable of doing so.

A substantial demonstration project update is slated for the fall GAC
meeting.

***Related Questions/Comments:***

Chief Harlin McEwen, GAC and GESC member representing the International
Association of Chiefs of Police (IACP), pointed out that while
technology can make significant inroads towards addressing the problem
of identity management, the *human* oversight factor will remain a key
challenge. "In my view---and I've said this before---the bigger problem
is the management of all of this. Keep in mind that in the law
enforcement world alone, every week hundreds of police officers die,
retire, get fired, change their position, get promoted, get moved from
one assignment to another---in other words, their status changes, and
that affects the way that access works. Management of personnel and how
we keep track of *who* has access to *what* (and under whose authority)
is a huge undertaking . . . ." Many attendees concurred.

Concluding the GSWG portion of the agenda, Chief McEwen provided a
presentation on the current state of the wireless information sharing
environment, highlighting some of the key issues and challenges. He
noted, "The reason I'm raising the Wi-Fi issue is because right now,
around the country, there is a move by local municipalities, cities, and
counties to look at providing public wireless services where broadband
isn't readily accessible. This is very controversial, and in my view,
unlicensed spectrum Wi-Fi services are not reliable or secure enough for
the kinds of information we need to use and exchange." He distributed a
complementary handout for more information.

***Global Infrastructure/Standards Working Group (GISWG)***

GISWG Chairman Tom Clarke, GAC member representing the National Center
for State Courts, provided a briefing on major activities since the last
GAC meeting, including efforts by the following groups and/or projects:

-   **BJA-sponsored Messaging Focus Group**

    -   Goal: interoperable message delivery

    -   Participants: 19 invited technical experts

        -   Local, state, and federal government and industry

        -   Justice and emergency management

    -   Final report issued April 2006

    -   Some recommendations are already included in the Justice
        Reference Architecture (JRA) draft

-   **Justice Reference Architecture**

    -   Goal: provide guidelines and technical standards in all areas of
        interoperability

    -   The JRA is based on concepts from the Organization for the
        Advancement of Structured Information Standards (OASIS) body

        -   Added concepts from Messaging Focus Group

        -   Added governance concepts from Global and industry

-   **GISWG Activities/Priorities**

    -   To recommend governance structure for reference document
        standards (IEPD)

    -   To recommend principles to guide development of the JRA

    -   To identify and prioritize justice services by building on the
        Justice Information Exchange Model

    -   To develop concepts for message delivery

-   **GJXDM Training and Technical Assistance Committee
    Activities/Priorities**

    -   Sponsoring second GJXDM Users' Conference,[^17] to be held\
        September 6-8, 2006, in San Diego, California

    -   Creating educational and marketing materials for GJXDM and JRA

    -   Rewriting and teaching GJXDM executive and technical briefings

    -   Recommending a strategy for IEPD consistency and reusable data
        modules

-   **Global XSTF Activities/Priorities**

    -   Rearchitecting GJXDM into reusable data modules

        -   Ensuring NIEM compatibility

        -   Modifying implementation of relationships

    -   Expanding GJXDM content

    -   Increasing collaboration (NIEM, OASIS, and U.S. Departments of
        Transportation \[DOT\] and Health and Human Services \[HHS\])

    -   Attacking specific problems (e.g., privacy)

-   **GISWG Collaboration**

    -   Coordinating with the Global Security Working Group (GSWG) on a
        set of deliverables for the JRA

    -   Coordinating with the Global Privacy and Information Quality
        Working Group (GPIQWG) on a set of deliverables for the JRA

    -   Working with NIEM (DOJ/DHS/ODNI) to coordinate JRA with the
        Federal Enterprise Architecture and NASCIO Enterprise
        Architecture

No formal GAC recommendations or actions were requested during this
presentation.

***Global Intelligence Working Group (GIWG)***

Mr. Russell Porter, Iowa Department of Public Safety and vice chair of
the Criminal Intelligence Coordinating Council (CICC), delivered the
GIWG/CICC briefing as the proxy for GIWG/CICC Chairman Joseph Polisar.

Vice Chairman Porter presented *Fusion Center Guidelines: Law
Enforcement Intelligence, Public Safety, and the Privacy Sector*[^18]
(*Guidelines)* for GAC consideration and **request for recommendation**
(Committee members were provided copies for advance review). By way of
background, as part of Global's efforts to develop fusion center
guidelines, the CICC recommended the creation of the Intelligence Fusion
Center Focus Group (Focus Group). This focus group was tasked with
recommending guidelines specifically for the law enforcement
intelligence component of fusion centers. Concurrently, the Homeland
Security Advisory Council (HSAC) Intelligence and Information Sharing
Working Group focused on developing guidelines for local and state
agencies in relation to the collection, analysis, and dissemination of
terrorism-related intelligence in the context of fusion centers. The
recommendations resulting from DOJ\'s Fusion Center Guidelines
initiative, as well as those developed by HSAC's efforts, provided the
foundation for development of these fusion center guidelines for law
enforcement intelligence, public safety, and private sector entities.
As\
Vice Chairman Porter noted, "You have previously seen version one of
this report, focusing on the law enforcement entities. This is version
two, building on that earlier document by including recommendations and
guidance for public safety entities as well as private sector entities.
Thus far, version two has been vetted not only through the focus group
members that helped create the document, but also the GIWG, CICC, BJA,
the DHS components (including the Homeland Security Advisory Council),
and DOJ's Justice Intelligence Coordinating Council. They've endorsed
it, and there is a memo . . . . to go to the Deputy AG supporting the
document. We're already getting requests for this document---there's a
great hunger for it."

Pending approval from the GAC, the *Guidelines* will be submitted to the
Attorney General (AG), with anticipated widespread dissemination in the
near future. Additionally, regional meetings of fusion center directors
are in the planning stages. These events will be cosponsored by DOJ,
DHS, ODNI, and the FBI. Chairman Bouche expressed, "This is a really
good, collaborative effort."

> **Recommendation:** Mr. Wicklund moved that the GAC accept the
> *Guidelines,* for submittal to the AG as a Global product for further
> action and widespread distribution. Ms. Uecker seconded.
>
> **Action:** The motion was brought to a vote and passed unanimously.

Vice Chairman Porter concluded by providing an update on the GIWG task
team subject areas, to be addressed at the upcoming working group
meeting on May 18 and 19, 2006. Teams will be concerned with:

1.  Exploring preliminary development of NISS, to provide specificity to
    the national information sharing environment and expand on the
    tenets outlined in the NCISP.

2.  Developing recommendations on improving the information and
    intelligence gathering and sharing efforts regarding the gang
    problem that is plaguing the nation.

3.  Developing recommendations for including the NCISP in national law
    enforcement accreditation standards. The goal of this effort is the
    continued institutionalization of the NCISP.

4.  Reviewing 28 Code of Federal Regulations (CFR) Part 23 to determine
    whether any updates and/or revisions should be recommended to
    enhance the regulation.

5.  Supporting the development of a policy paper that provides
    recommendations on information which is received or possessed by law
    enforcement agencies that does not rise to the level of "reasonable
    suspicion of criminal activity." This information is sometimes
    referred to as temporary working files or tips and leads.

6.  Developing a recommended national policy on sensitive but
    unclassified (SBU) information.

***Global Privacy and Information Quality Working Group (GPIQWG)***

Mr. Robert Boehmer, GAC member representing the National Criminal
Justice Association and chairman of the GPIQWG, provided his briefing
with the assistance of Mr. Paul Wormeli and Ms. Moira Rowley of the IJIS
Institute. The presentation focused on the BJA-sponsored Privacy
Technology Focus Group and resulting recommendations.

By way of background: On November 1--3, 2005, BJA gathered a group of
public and private sector specialists to focus specifically on privacy
*technology* (as opposed to privacy policy). This Privacy Technology
Focus Group (Focus Group) was chartered to examine the use and exchange
of personally identifiable information (PII) in the context of justice
information systems and in the dissemination and aggregation of justice
and public safety data. The event was sponsored by BJA, in partnership
with Global and the IJIS Institute. Ms. Rowley served as the meeting
facilitator. The carefully selected group of practitioners,
policymakers, and technologists met in Phoenix, Arizona, to identify
existing and emerging technologies to support justice-related privacy
policies.

Focus Group members:

-   Identified their most important privacy policy and technology
    issues.

-   Narrowed the focus to areas that could be adequately addressed in
    the given timeframe.

-   Outlined tangible, targeted technology solutions.

-   Developed specific recommendations for action.

On-site, each focus group participant submitted five issues he/she
thought were critical to privacy policy and had the potential of being
addressed by technology. The collected issues were categorized into a
list of subjects. Participants formed three separate work teams and
selected what they considered to be priority subjects from that list.

Working teams addressed the following subject matters:

-   Access and Authentication

-   Data Aggregation and Dissemination

-   Identity Theft

-   Personal Safety and Protection

Each working team produced a report and recommendations for their
selected topics. Their conclusions are summarized in the following
charts.

+------------------+------------------------------------------------+---+
| **Working Team   |                                                |   |
| One**            |                                                |   |
+------------------+------------------------------------------------+---+
| **Access and     |                                                |   |
| Authentication** |                                                |   |
+------------------+------------------------------------------------+---+
| **Issue**        |                                                |   |
|                  |                                                |   |
| How do you       |                                                |   |
| foster an        |                                                |   |
| appropriate      |                                                |   |
| balance between  |                                                |   |
| *effective       |                                                |   |
| information      |                                                |   |
| sharing* and     |                                                |   |
| *privacy*?       |                                                |   |
| Specifically,    |                                                |   |
| what approaches  |                                                |   |
| are necessary to |                                                |   |
| develop          |                                                |   |
| appropriate,     |                                                |   |
| interoperable,   |                                                |   |
| and adaptable    |                                                |   |
| business rules   |                                                |   |
| and technical    |                                                |   |
| standards to     |                                                |   |
| ensure that only |                                                |   |
| authorized       |                                                |   |
| people have      |                                                |   |
| access to the    |                                                |   |
| information      |                                                |   |
| appropriate to   |                                                |   |
| their roles and  |                                                |   |
| privileges?      |                                                |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Develop standard elements/components for       |   |
| 1**              | interoperability (suggested outline contained  |   |
|                  | in report).                                    |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Commission appropriate ad hoc entity(ies) of   |   |
| 2**              | public and private policy experts and/or       |   |
|                  | technologists to define technical requirements |   |
|                  | associated with the Federated Identity (ID)    |   |
|                  | Management and Service-Oriented Architecture   |   |
|                  | (SOA).                                         |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Create an inventory of Federated ID Management |   |
| 3**              | technologies, and conduct a privacy-related    |   |
|                  | architectural gap analysis to determine if     |   |
|                  | additional technologies should be used.        |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Review and create, where needed, privacy       |   |
| 4**              | metadata (e.g., reliability, sensitivity, use  |   |
|                  | limitations, and personally identifiable       |   |
| *Related to #12* | information) in the Global JXDM.               |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Create a matrix, defining roles and associated |   |
| 5**              | services, to serve as a model to develop       |   |
|                  | business rules and standards related to data   |   |
|                  | content and messaging architectures.           |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Commission further work to properly identify   |   |
| 6**              | supporting technologies related to Federated   |   |
|                  | ID Management and SOA and their impact on      |   |
|                  | privacy.                                       |   |
+------------------+------------------------------------------------+---+
| **Recommendation | Appoint a cross-skilled team                   |   |
| 7**              | (policy/practitioners/technologists from       |   |
|                  | public and private sectors) to evaluate and    |   |
|                  | revise the Fair Information Principles (FIPs)  |   |
|                  | as they relate to specific justice             |   |
|                  | circumstances and technologies.                |   |
+------------------+------------------------------------------------+---+

+------------------+---------------------------------------------------+
| **Working Team   |                                                   |
| Two**            |                                                   |
+------------------+---------------------------------------------------+
| **Data           |                                                   |
| Aggregation and  |                                                   |
| Dissemination**  |                                                   |
+------------------+---------------------------------------------------+
| **Issue**        |                                                   |
|                  |                                                   |
| There is a       |                                                   |
| sustained trend  |                                                   |
| within the       |                                                   |
| justice          |                                                   |
| community to     |                                                   |
| move away from   |                                                   |
| "silo" models of |                                                   |
| information      |                                                   |
| (e.g., disparate |                                                   |
| records and case |                                                   |
| management and   |                                                   |
| emergency        |                                                   |
| response         |                                                   |
| systems) to      |                                                   |
| integrated       |                                                   |
| public safety    |                                                   |
| operational and  |                                                   |
| intelligence     |                                                   |
| systems. As      |                                                   |
| access to data   |                                                   |
| becomes more and |                                                   |
| more ubiquitous, |                                                   |
| technologies     |                                                   |
| must be          |                                                   |
| implemented to   |                                                   |
| ensure lawful    |                                                   |
| access control   |                                                   |
| and use and      |                                                   |
| meaningful       |                                                   |
| oversight,       |                                                   |
| thereby ensuring |                                                   |
| compliance with  |                                                   |
| privacy          |                                                   |
| policies.        |                                                   |
+------------------+---------------------------------------------------+
| **Recommendation | Prepare a policy paper on data anonymization and  |
| 8**              | its value for privacy protection. **Note:         |
|                  | Anonymization\***[^19] **is [not]{.underline}     |
|                  | synonymous with anonymous**.                      |
+------------------+---------------------------------------------------+
| **Recommendation | Develop a strategic plan for use of anonymization |
| 9**              | in justice, public safety, and homeland security  |
|                  | efforts to protect privacy while enhancing        |
|                  | information sharing.                              |
+------------------+---------------------------------------------------+
| **Recommendation | Request that the Global Justice Information       |
| 10**             | Sharing Initiative support development of         |
|                  | standards for audit functions.                    |
+------------------+---------------------------------------------------+
| **Recommendation | Request that the National Institute of Justice    |
| 11**             | conduct a research project on the maturity and    |
|                  | applicability of immutable audit capabilities.    |
+------------------+---------------------------------------------------+
| **Recommendation | Assemble or use existing groups to identify       |
| 12** *Related to | privacy-related metadata and its links to         |
| #4*              | business rules.                                   |
+------------------+---------------------------------------------------+
| **Recommendation | Determine mechanisms to ensure persistence of     |
| 13**             | metadata throughout transfer, aggregation, and    |
|                  | dissemination of data. Refer to the XML Structure |
|                  | Task Force (XSTF) to build into the GJXDM.        |
+------------------+---------------------------------------------------+

+------------------+-------------------------------------------------+---+
| **Working Team   |                                                 |   |
| Three**          |                                                 |   |
+------------------+-------------------------------------------------+---+
| **Identify       |                                                 |   |
| Theft**          |                                                 |   |
+------------------+-------------------------------------------------+---+
| **Issue**        |                                                 |   |
|                  |                                                 |   |
| The pervasive    |                                                 |   |
| and growing      |                                                 |   |
| problem of       |                                                 |   |
| identity theft   |                                                 |   |
| manifests itself |                                                 |   |
| in myriad forms. |                                                 |   |
| Justice          |                                                 |   |
| information is   |                                                 |   |
| certainly as     |                                                 |   |
| susceptible to   |                                                 |   |
| identity theft   |                                                 |   |
| as any other     |                                                 |   |
| information,     |                                                 |   |
| whether paper or |                                                 |   |
| electronic,      |                                                 |   |
| internal, or     |                                                 |   |
| publicly         |                                                 |   |
| available.       |                                                 |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Identify best practices that ensure data        |   |
| 14**             | quality is a priority throughout near-term and  |   |
|                  | long-term business processes and technology     |   |
|                  | solutions.                                      |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Establish a grant condition requiring           |   |
| 15**             | applicants/grantees to address identity         |   |
|                  | management in plans and outcomes for programs   |   |
|                  | and systems development supported by national   |   |
|                  | funding.                                        |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Through funding, training, and technical        |   |
| 16**             | assistance, encourage local, county, state, and |   |
|                  | regional agencies to move towards foundational  |   |
|                  | components, such as open data standards Global  |   |
|                  | JXDM and the National Information Exchange      |   |
|                  | Model (NIEM) and baseline definition of         |   |
|                  | identity data elements.                         |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Through funding, training, and technical        |   |
| 17**             | assistance, encourage local, county, state, and |   |
|                  | regional agencies to categorize data within     |   |
|                  | existing and/or new systems.                    |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Through funding, training, and technical        |   |
| 18**             | assistance, encourage local, county, state, and |   |
|                  | regional agencies to develop and undertake      |   |
|                  | projects related to strong authentication and   |   |
|                  | identification of the user.                     |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Develop enforceable policies and practices,     |   |
| 19**             | such as audit logs, that appropriately respond  |   |
|                  | to potential systems misuse.                    |   |
+------------------+-------------------------------------------------+---+
| **Recommendation | Form a task force to evaluate how personally    |   |
| 20**             | identifiable information (PII) is obtained or   |   |
|                  | collected and should be treated.                |   |
+------------------+-------------------------------------------------+---+

+-----------------+--------------------------------------------------+---+
| **Working Team  |                                                  |   |
| Three**         |                                                  |   |
+-----------------+--------------------------------------------------+---+
| **Personal      |                                                  |   |
| Safety and      |                                                  |   |
| Protection**    |                                                  |   |
+-----------------+--------------------------------------------------+---+
| **Issue**       |                                                  |   |
|                 |                                                  |   |
| Information     |                                                  |   |
| collected and   |                                                  |   |
| disseminated by |                                                  |   |
| the justice     |                                                  |   |
| system related  |                                                  |   |
| to a person's   |                                                  |   |
| safety or       |                                                  |   |
| protection must |                                                  |   |
| also be         |                                                  |   |
| safeguarded.    |                                                  |   |
| For example:    |                                                  |   |
|                 |                                                  |   |
| -   Location of |                                                  |   |
|     a stalking  |                                                  |   |
|     victim      |                                                  |   |
|                 |                                                  |   |
| -   Officials'  |                                                  |   |
|     home        |                                                  |   |
|     addresses,  |                                                  |   |
|     phone       |                                                  |   |
|     numbers,    |                                                  |   |
|     and other   |                                                  |   |
|     PII         |                                                  |   |
|                 |                                                  |   |
| -   Identity of |                                                  |   |
|     a rape      |                                                  |   |
|     victim      |                                                  |   |
|                 |                                                  |   |
| -               |                                                  |   |
|    Confidential |                                                  |   |
|     information |                                                  |   |
|     such as     |                                                  |   |
|     physical    |                                                  |   |
|     health or   |                                                  |   |
|     mental      |                                                  |   |
|     health      |                                                  |   |
+-----------------+--------------------------------------------------+---+
| **Re            | The working group concluded that recommendations |   |
| commendations** | from the preceding three working team reports    |   |
|                 | address this issue.                              |   |
+-----------------+--------------------------------------------------+---+

Common elements expressed by all three teams are just as important as
the working teams' separate recommendations. These common assertions
include:

-   Technology can support privacy policies to the extent that those
    policies are reliably and specifically expressed within technology
    frameworks.

-   Interoperability is dependent upon consistency and open standards.
    *Standards* in the technological world can be (and often are) more
    detailed and structured than *policy* in the executive world.

-   Within the justice community, there is currently a gap between
    technological capabilities and open standards to support the
    consistent explanation, dissemination, and implementation of privacy
    policy.

-   While technologists may be of assistance in translating *policy* to
    *technology*, agency executives and information stewards must
    clearly articulate those policies and ensure they are adequately and
    accurately reflected in the application of technologies.

-   Fair Information Principles (FIPs) are the backbone of most current
    privacy policy for the justice community. Each working team
    requested a review and refinement of the FIPs as they relate to
    specific justice circumstances and today's technology environment
    and capabilities.

-   Universally understood, accepted, and supported privacy technology
    solutions depend on a commonly understood lexicon. A comprehensive
    glossary of related terms should be developed as a next step in this
    process.

-   Specific technology solutions may be constrained by local
    infrastructure; therefore, to avoid an all-or-nothing approach to
    solutions, it is important to look at a range of options rather than
    limit recommendations to only the most recent (and usually most
    effective) technological solutions.

-   Use and refinement of the GJXDM to support privacy elements will
    play a key role in future work.

-   Whenever possible, stakeholders and funding authorities should
    encourage and support the ability of each jurisdiction and
    information sharing community to acquire and employ the most
    effective technology solutions.

-   Support comes in various forms, but in some measure, it is tied to
    local, state, tribal, and national initiatives and funding
    mechanisms. Ensuring currency of information and considerations of
    these groups will require close and continued coordination among
    policy bodies, funding authorities, technologists, practitioners,
    executive sponsors, and private sector partners.

-   Determining appropriate access to and safeguarding against
    unauthorized use of data requires more, not less, information to
    ensure positive identification of persons and roles.

-   Even the most effective privacy policy technology solutions will be
    subject to the inherent risks associated with human behavior. Good
    technology solutions work in tandem with sound business practices
    and vigilant monitoring.

The ongoing commitment of the Privacy Technology Focus Group
participants---from the Steering Committee members to the working team
leaders to the invitees---cannot be overstated: all attendees expressed
sincere interest in continuing this work and pledged to contribute
future time and effort to further refine the recommendations in this
report.

As a follow-up activity, members of the Focus Group Steering Committee
(including Mr. Wormeli and Ms. Rowley) prioritized their top five
recommendations from the suite proffered at the Phoenix meeting. As
identified by the Steering Committee, the top privacy technology
recommendations for further action are (from highest priority):

1.  Assemble or use existing groups to identify privacy-related metadata
    and its links to business rules.

2.  Commission appropriate ad hoc entity(ies) of public and private
    policy experts and/or technologists to define technical requirements
    associated with the Federated Identity (ID) Management and
    Service-Oriented Architecture (SOA).

3.  Create a matrix defining roles and associated services to serve as a
    model to develop business rules and standards related to data
    content and messaging architectures.

4.  Review and create, where needed, privacy metadata (e.g.,
    reliability, sensitivity, use limitations, and personally
    identifiable information) in the GJXDM.

5.  Determine mechanisms to ensure persistence of metadata throughout
    transfer, aggregation, and dissemination of data. Refer to the XML
    Structure Task Force (XSTF) to build into the GJXDM.

Chairman Boehmer noted that while future Focus Group activities may be
warranted, it is gratifying to see that many of the recommendations from
the Phoenix meeting are currently being addressed by Global working
groups and committees. Not only does this externally validate the
prioritization of GAC activities by a prestigious body of policy and
technology experts, but it shows that Global-affiliated Focus Group
participants took what they learned in Phoenix and applied that
knowledge to shape GAC efforts.

No formal recommendations or actions were requested during this
presentation.

**Concluding Business, Next Meeting, and Adjourn**

[]{.mark}

Chairman Bouche highlighted two matters of Committee business:

[]{.mark}

> **Action:** Per decision by Global leaders, GAC member biographies and
> pictures will be added to the OJP IT/Global Web site.

This is a request, not a requirement of membership. The goal is to
increase Global awareness throughout the justice and public safety
communities, facilitate outreach vis-à-vis face/name recognition, and
acknowledge members for their commitment and volunteerism to the
Initiative. Committee representatives were asked to send their
information to Global staff. Additionally, staff will be available to
assist in crafting biographies for the Web format, and will be on-site
at the fall 2006 meeting to take photographs of members wishing a
current picture.

A key agenda item on the fall 2006 GAC agenda will be the election of
the Committee chair and vice chair.

> **Request for Global member action:** In preparation for that event,
> Chairman Bouche requested a volunteer to serve as the Elections chair.
> This position is responsible for e-soliciting nominations,
> communicating voting rules (with staff assistance) in advance of the
> fall meeting, and conducting elections on-site.

Chairman Bouche encouraged everyone to run for leadership of the GAC.
However, for those who choose not to, serving as the Elections chair is
an important way to contribute to the process on a limited-time basis.
Interested parties should contact Global staff at <drinehart@iir.com> or
(850) 385-0600, extension 285.

In conclusion, Chairman Bouche thanked Committee members, program
officials, presenters, and guests for their participation and expertise.
He reviewed the dates of the upcoming Global working group meetings[^20]
and requested GAC members not already involved in a working group to
"make that commitment."[^21]

> **Action:** The date of the [fall 2006]{.underline} GAC meeting was
> announced as [November 2]{.underline}. The date of the [spring
> 2007]{.underline} GAC meeting was announced as [April 18]{.underline}.
> Members were asked to mark their calendars for these events.

Having no further business and hearing no further questions, Chairman
Bouche adjourned the meeting at 3:30 p.m. on April 26, 2006.

[]{.mark}

[]{.mark}

[]{.mark}

**Attachment A**

*Global Advisory Committee*

*Spring 2006 Meeting Agenda*

[]{.mark}

[]{.mark}

[]{.mark}

**Attachment B**

*U.S. Department of Justice*

*Law Enforcement Information Sharing Plan (LEISP)*

*\
*

[]{.mark}

[]{.mark}

[]{.mark}

**Attachment C**

*National Information Exchange Model (NIEM)*

*Status Update*

[^1]: More information on OJP, which houses the Bureau of Justice
    Assistance, National Institute of Justice, and Office for Victims of
    Crime (among other entities), is available at
    [http://www.ojp.usdoj.gov](http://www.ojp.usdoj.gov/).

[^2]: More information on the Global Initiative is available at
    <http://www.it.ojp.gov/global>.

[^3]: The agenda is included as ***Attachment A.***

[^4]: More information on PSN is available at
    [http://www.psn.gov](http://www.psn.gov/).

[^5]: For more information on the NSOPR, please see
    [http://www.nsopr.gov](http://www.nsopr.gov/).

[^6]: At <http://it.ojp.gov/documents/20051020_GAC_meeting_summary.doc>.

[^7]:   Hard copies of Global documents are available from Global
    support staff by calling\
    (850) 385-0600, extension 285.

[^8]: Included as ***Attachment B.***

[^9]: Global members contributed significantly to the initial LEISP
    development through review-and-comment participation.

[^10]: Including FBI, DEA, U.S. Marshals Service, Bureau of Alcohol,
    Tobacco, Firearms and Explosives (ATF), U.S. Attorneys, and Federal
    Bureau of Prisons.

[^11]: More information on the LInX project is available at
    [http://policechiefmagazine.org/magazine
    /index.cfm?fuseaction=display_arch&article_id=684&issue_id=92005](http://policechiefmagazine.org/magazine /index.cfm?fuseaction=display_arch&article_id=684&issue_id=92005).

[^12]: For more information on NIEM, please see
    [http://www.niem.gov](http://www.niem.gov/).

[^13]: The content for this EDS paragraph was informed by Director
    Reingold's remarks and information available at
    <http://www.fas.org/irp/congress/2006_hr/051006mcnamara.pdf>.

[^14]: Included as ***Attachment C.***

[^15]: For a related article, *The Pandemic Influenza Plan: Implications
    for Local Law Enforcement,* by\
    Lee Colwell, D.P.A., please see the International Association of
    Chiefs of Police's (IAC) [Police Chief Magazine]{.underline} link at
    [http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction
    =display
    &article_id=784&issue_id=12006](http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction =display &article_id=784&issue_id=12006).

[^16]: The NCISP laid the foundation for the effective development and
    sharing of criminal intelligence and information among law
    enforcement and homeland security agencies, and the next step should
    be to build upon this foundation and recommend the most effective
    use of the current information sharing environment.

[^17]: Please see <http://it.ojp.gov/topic.jsp?topic_id=204> for more
    information.

[^18]: Executive summary at <http://it.ojp.gov/topic.jsp?topic_id=209>.

[^19]: In this document, the term "data anonymization" refers to
    technology that converts clear text data into a nonhuman readable
    and irreversible form, including but not limited to preimage
    resistant hashes (e.g., one-way hashes) and encryption techniques in
    which the decryption key has been discarded. Data is considered
    anonymized even when conjoined with pointer or pedigree values that
    direct the user to the originating system, record, and value (e.g.,
    supporting selective revelation) and when anonymized records can be
    associated, matched, and/or conjoined with other anonymized records.

    Data anonymization enables the transfer of information across a
    boundary, such as between two departments within an agency or
    between two agencies, while reducing the risk of unintended
    disclosure, and in certain environments in a manner that enables
    evaluation and analytics post-anonymization.

[^20]:   Global events are listed on the OJP IT Event Calendar, located
    at [http://it.ojp.gov/topic.jsp
    ?topic_id=5](http://it.ojp.gov/topic.jsp ?topic_id=5).

[^21]:   To volunteer for a working group or learn more about
    opportunities for Global involvement, Committee members should call
    Global staff at (850) 385-0600, extension 285.