![](media/image1.png){width="4.802083333333333in" height="0.71875in"}

![](media/image2.png){width="1.4618055555555556in"
height="1.6423611111111112in"}

**Privacy Impact Assessment (PIA)**

**for the**

**I-Web General Support System (GSS)**

![](media/image3.wmf)*Prepared by:*

**REVISION AND HISTORY PAGE**

+---------+-----------+-----------+-----------+-----------+-----------+
| **Doc   | *         | **Desc    | **Section | **Page    | **I       |
| ument** | *Revision | ription** | #/**      | \#**      | nitials** |
|         | Date**    |           |           |           |           |
| **      |           | **of      | **        |           |           |
| Version |           | Change**  | Paragraph |           |           |
| \#**    |           |           | \#**      |           |           |
+---------+-----------+-----------+-----------+-----------+-----------+
| V1.1    | 8/22/2006 | Review    | Entire    |           | CG -- FS- |
|         |           |           |           |           | IRM       |
+---------+-----------+-----------+-----------+-----------+-----------+
| V1.2    | 6/19/07   | UPDATE    | ALL       | ALL       | MSP       |
+---------+-----------+-----------+-----------+-----------+-----------+
|         |           |           |           |           |           |
+---------+-----------+-----------+-----------+-----------+-----------+
|         |           |           |           |           |           |
+---------+-----------+-----------+-----------+-----------+-----------+
|         |           |           |           |           |           |
+---------+-----------+-----------+-----------+-----------+-----------+
|         |           |           |           |           |           |
+---------+-----------+-----------+-----------+-----------+-----------+

**FORWARD** [iii](#__RefHeading___Toc127681096)

1 INTRODUCTION [1](#introduction)

1.1 Purpose [1](#purpose)

1.2 Scope [1](#scope)

1.2.1 System Description [1](#system-description)

1.3 Objectives [2](#objectives)

1.4 Contents [2](#contents)

1.5 Responsible Organization and Information Contacts
[2](#responsible-organization-and-information-contacts)

1.5.1 Responsible Organization [2](#responsible-organization)

1.5.2 Information Contacts [2](#information-contacts)

2 PRIVACY IMPACT ASSESSMENT [4](#privacy-impact-assessment)

2.1 Introduction [4](#introduction-1)

2.2 Assessment [4](#assessment)

2.3 Data In the System [5](#data-in-the-system)

2.4 Access To The Data [6](#access-to-the-data)

2.5 Attributes Of The Data [7](#attributes-of-the-data)

2.6 Maintenance Of Administrative Controls
[8](#maintenance-of-administrative-controls)

[]{#__RefHeading___Toc127681096 .anchor}**FORWARD**

*The need to address the privacy of a system is an increasingly
important piece of the development process. Privacy while using a system
is potentially the most important aspect of a system, as it ensures that
the system maintains the appropriate security controls in order to
operate in a secure manner. A Privacy Impact Assessment (PIA) is a
document that analyses the privacy implications of the application. It
looks at compliance with the Privacy Act 1993, Children's Online Privacy
Protection Act of 1998, Freedom of Information Act, Paperwork Reduction
Act of 1995, Office of Management and Budget Memoranda M-99-18 dated
June 2, 1998 and M-00-13 dated June 22, 2000 and OCIO memorandum, Use of
Cookies on Web Pages, DR 3410-1, Information Collection Activities, and
DR 3080-1, Records Disposition, but also at wider privacy issues and
concerns. The PIA is a framework to manage Privacy Risks.*

#  {#section .unnumbered}

# INTRODUCTION

## Purpose

This is the Privacy Impact Assessment (PIA) for the United States
Department of Agriculture (USDA) Forest Service (FS) I-Web General
Support System (GSS). The I-Web GSS PIA addresses the privacy of
information in use on the system and privileges when the system is in
operation. This PIA provides staff and system owners:

-   Privacy information with regard to whether the system contains and
    protects information adequately.

-   A synopsis of privacy concerns with the system.

-   An assessment of the privacy of information contained on the system.

This document provides guidance on the level of privacy that the system
maintains. It is an assessment based on a set of answers to questions
regarding the privacy of the system. The impact of those privacy
concerns not being implemented is at the discretion of the system owner.
It is recommended however that the system owner take into account the
answers to the questions presented in the assessment and make changes as
needed. The document is meant to make the system owner aware of the
privacy implications associated with the system and whether or not the
system meets the guidelines set out by the USDA and the Forest Service.

Included in this document is a PIA assessment form with a set of
questions and answers. The answers to the questions represent the
privacy impact assessment of the system. The document is intended to
measure the impact to privacy with the introduction of the system into
the environment.

## Scope

This document provides information and analysis of:

-   Data in the system (Section 2.3)

-   Access to the data (Section 2.4)

-   Attributes of the data (Section 2.5)

-   Maintenance of Administrative Controls (Section 2.6)

### System Description

I-Web is a web-enabled General Support System (GSS) that hosts a suite
of database applications for various Forest Service business areas.
I-Web stores all data in a centralized database located at the USDA\'s
National Information Technology Center (NITC) in Kansas City, MO. I-Web
is scalable and provides nationally consistent storage, access,
reporting, and analytical capabilities for essential Forest Service
inventory and business needs.

I-Web leverages the USDA eAuthentication Service in conjunction with a
commercial-off-the-shelf (COTS) Oracle Single Sign-On (SSO) application
called Oracle Internet Directory (OID), and a customized COTS Oracle
User Management Application (UMA) that automates and distributes account
management process including user registration and management approval,
oversight, and authorization processing to hosted application users and
managers.

## Objectives

This document's objectives are as follows:

-   To provide detailed information of the impact to privacy of system
    users.

-   To make available information on what the system does in regards to
    privacy whenever it is accessed and maintained.

-   To demonstrate that the appropriate controls are in place to keep
    data private as a result of use.

The PIA is not intended to be a guide on what is wrong with the system
or to demonstrate vulnerabilities. Its basic function is to provide the
system owner with the information necessary to determine whether or not
the system provides adequate privacy to the agency and its users.

## Contents

The PIA is composed of an assessment form that asks and answers a series
of questions in regard to the privacy of the system and whether or not
it is adequate to protect and maintain the information processed within
it.

## Responsible Organization and Information Contacts

### Responsible Organization

The organization responsible for the I-Web assessment is the USDA FS
Forest Management Staff:

Forest Management Staff

USDA Forest Service

201 14^th^ Street, SW

3SW

Washington D.C. 20250

### Information Contacts

Designated Approving Authority

Joel Holtrop

Deputy Chief for National Forest System

> USDA Forest Service
>
> \(202\) 205-1523
>
> E-mail: [jholtrop@fs.fed.us](mailto:tthompson@fs.fed.us)

Certifying Official

Vaughn Stokes

Chief Information Officer

USDA Forest Service

RPE 7

1601 Kent Street

Arlington, VA 22209

\(703\) 605-4814

E-mail: <vstokes@fs.fed.us>

I-Web System Owner

Lou Leibbrand

Director, FS Engineering

USDA Forest Service

1601 N. Kent, RPC 5

Arlington, VA 22209

\(703\) 605-4525

E-mail: <lleibbrand@fs.fed.us>

I-Web System Manager (FS)

> Sue Preece

I-Web Program Manager

RPC5

1601 N. Kent Street

Arlington, VA 22209

\(703\) 605-4643

E-mail: <spreece@fs.fed.us>

I-Web Operations Manager (NITC)

Paul Clemens

1601 N. Kent Street

RPC5

Arlington, VA 22209

(703)605-1175

E-mail: [pclemens@fs.fed.us](../jeff.claunch@usda.gov)

I-Web Database Operations Manager (FS)

Paul Le

USDA Forest Service

1601 N. Kent Street

RPC3

Arlington, VA 22209

(703)605-4191

E-mail: <paulle@fs.fed.us>

# PRIVACY IMPACT ASSESSMENT

## Introduction

The objective of the PIA is to assist USDA Forest Service employees in
identifying information privacy when planning, developing, implementing,
and operating agency owned applications. The PIA will help USDA
employees consider and evaluate whether existing statutory requirements
are being applied to systems that contain personal information. These
requirements are drawn from the Privacy Act of 1993, Children's Online
Privacy Protection Act of 1998, Freedom of Information Act, Paperwork
Reduction Act of 1995, Office of Management and Budget Memoranda M-99-18
dated June 2, 1998 and M-00-13 dated June 22, 2000 and OCIO memorandum,
Use of Cookies on Web Pages, DR 3410-1, Information Collection
Activities, and DR 3080-1, Records Disposition

The PIA is a Federal Government requirement that helps to ensure that
system owners and developers consider and evaluate existing statutory
information management requirements that must be applied to new or
modified applications that contain personal information. The goals
accomplished in completing this PIA include:

-   Providing USDA management with the tools to make informed policy and
    system design decisions.

-   Ensuring accountability for privacy issues.

-   Ensuring a consistent format and structured process for analyzing
    both technical and legal compliance of the application.

-   Providing basic documentation on the flow of personal information
    within the application.

## Assessment

A review of the system, as installed by USDA, indicates that I-Web does
not maintain identifiable form of information on individual members of
the public. The system provides the infrastructure for hosted major
applications. It also stores identification and authentication
information such as forest service email addresses and I-Web user names.
Controls are in place to protect unauthorized access to or disclosure of
data. A completed USDA Privacy Impact Assessment Form is provided in
Sections 2.3 through 2.6, below.

+--------------------------+-------------------------------------------+
| ## Data In the System    |                                           |
+--------------------------+-------------------------------------------+
| 1\. Generally describe   | > I-Web stores Forest Service employee    |
| the information to be    | > user name, user email, and USDA         |
| used in the system in    | > eAuthentication Service eAuthentication |
| each of the following    | > Identification (EID) number in a user   |
| categories: Customer,    | > management database application called  |
| Employee, and Other.     | > the User Management Application (UMA).  |
|                          | > This information is used authenticate   |
|                          | > the user based on eAuthentication       |
|                          | > credentials during initial account      |
|                          | > set-up. Afterwards only the EID is used |
|                          | > for authentication in I-Web.            |
+--------------------------+-------------------------------------------+
| 2a. What are the sources | > The source of information comes from    |
| of the information in    | > USDA Forest Service onetime input from  |
| the system?              | > the USDA eAuthentication Service.       |
+--------------------------+-------------------------------------------+
| 2b. What USDA files and  | > USDA eAuthentication Service LDAP       |
| databases are used? What | > database.                               |
| is the source agency?    |                                           |
+--------------------------+-------------------------------------------+
| 2c. What Federal         | USDA.                                     |
| Agencies are providing   |                                           |
| data for use in the      |                                           |
| system?                  |                                           |
+--------------------------+-------------------------------------------+
| 2d. What State and Local | Not applicable.                           |
| Agencies are providing   |                                           |
| data for use in the      |                                           |
| system?                  |                                           |
+--------------------------+-------------------------------------------+
| 2e. From what other      | None.                                     |
| third party sources will |                                           |
| data be collected?       |                                           |
+--------------------------+-------------------------------------------+
| 2f. What information     | None.                                     |
| will be collected from   |                                           |
| the customer/employee?   |                                           |
+--------------------------+-------------------------------------------+
| 3a. How will data        | Not applicable.                           |
| collected from sources   |                                           |
| other than the USDA      |                                           |
| records and the customer |                                           |
| be verified for          |                                           |
| accuracy?                |                                           |
+--------------------------+-------------------------------------------+
| 3b. How will data be     | Data completeness is checked by USDA      |
| checked for              | eAuthentication Service prior to initial  |
| completeness?            | input into I-WEB UMA.                     |
+--------------------------+-------------------------------------------+

+--------------------------+-------------------------------------------+
| 3c. Is the data current? | The employee data in I-Web UMA is based   |
| How do you know?         | on original one-time input from           |
|                          | eAuthentication Service and data such as  |
|                          | email or name could change although it is |
|                          | no longer used after initial account      |
|                          | setup at this time.                       |
+--------------------------+-------------------------------------------+
| 3d. Are the data         | Yes, Data Dictionary, Design Document,    |
| elements described in    | Functional Requirements.                  |
| detail and documented?   |                                           |
| If yes, what is the name |                                           |
| of the document?         |                                           |
+--------------------------+-------------------------------------------+
| ## Access To The Data    |                                           |
+--------------------------+-------------------------------------------+
| 1\. Who will have access | I-Web Database administrators, hosted     |
| to the data in the       | application managers and I-Web helpdesk   |
| system (Users, Managers, | users will have access to the data in the |
| System Administrators,   | system. UMA users will have access to     |
| Developers, Other)?      | role and organization data only.          |
+--------------------------+-------------------------------------------+
| 2\. How is access to the | > Access determinations are made through  |
| data by a user           | > established FS policies and procedures  |
| determined? Are          | > that require identifying the users by   |
| criteria, procedures,    | > name and by their role in system        |
| controls, and            | > operation based on job function. Roles  |
| responsibilities         | > are clearly documented in the User      |
| regarding access         | > Management Application (UMA) Technical  |
| documented?              | > Design.                                 |
+--------------------------+-------------------------------------------+
| 3\. Will users have      | Users access is restricted by Role Based  |
| access to all data on    | Access Controls that limits them to data  |
| the system or will the   | access based on their role. DBA's will    |
| user's access be         | have full access to all data. Hosted      |
| restricted? Explain.     | application managers will have access to  |
|                          | limited data based on user                |
|                          | self-registration request/approval        |
|                          | conditions in the database that pertains  |
|                          | to their domain of management control.    |
|                          | Helpdesk users will have view access to   |
|                          | raw data in the database. Users will have |
|                          | view access to their own data only.       |
+--------------------------+-------------------------------------------+
| 4\. What controls are in | Create, update, and delete accesses are   |
| place to prevent the     | carefully controlled by Oracle roles.     |
| misuse (e.g. browsing,   | Different resource staff will have access |
| unauthorized use) of     | to different parts of I-Web for different |
| data by those having     | purposes.                                 |
| access?                  |                                           |
+--------------------------+-------------------------------------------+
| 5a. Do other systems     | No                                        |
| share data or have       |                                           |
| access to data in this   |                                           |
| system? If yes, explain. |                                           |
+--------------------------+-------------------------------------------+
| 5b. Who will be          | Not Applicable.                           |
| responsible for          |                                           |
| protecting the privacy   |                                           |
| rights of the customers  |                                           |
| and employees affected   |                                           |
| by the interface.        |                                           |
+--------------------------+-------------------------------------------+
| 6a. Will other agencies  | No.                                       |
| share data or have       |                                           |
| access to data in this   |                                           |
| system (International,   |                                           |
| Federal, State, Local,   |                                           |
| Other)?                  |                                           |
+--------------------------+-------------------------------------------+
| 6b. How will the data be | NA -- see 6a.                             |
| used by the agency?      |                                           |
+--------------------------+-------------------------------------------+
| 6c. Who is responsible   | NA -- see 6a.                             |
| for assuring proper use  |                                           |
| of the data?             |                                           |
+--------------------------+-------------------------------------------+
| #                        |                                           |
| # Attributes Of The Data |                                           |
+--------------------------+-------------------------------------------+
| 1\. Is the use of the    | Yes. The information collected and used   |
| data both relevant and   | is relevant and necessary to access I-Web |
| necessary to the purpose | and subsequent hosted application access. |
| for which the system is  |                                           |
| being designed?          |                                           |
+--------------------------+-------------------------------------------+
| 2a. Will the system      | No.                                       |
| derive new data or       |                                           |
| create previously        |                                           |
| unavailable data about   |                                           |
| an individual through    |                                           |
| aggregation from the     |                                           |
| information collected?   |                                           |
+--------------------------+-------------------------------------------+
| 2b. Will the new data be | No.                                       |
| placed in the            |                                           |
| individual's record      |                                           |
| (customer or employee)?  |                                           |
+--------------------------+-------------------------------------------+
| 2c. Can the system make  | No.                                       |
| determinations about     |                                           |
| customers or employees   |                                           |
| that would not be        |                                           |
| possible without the new |                                           |
| data?                    |                                           |
+--------------------------+-------------------------------------------+
| 2d. How will the new     | Not applicable.                           |
| data be verified for     |                                           |
| relevance and accuracy?  |                                           |
+--------------------------+-------------------------------------------+

+--------------------------+-------------------------------------------+
| 3a. If data is being     | Not applicable. The data is not being     |
| consolidated, what       | consolidated                              |
| controls are in place to |                                           |
| protect the data from    |                                           |
| unauthorized access or   |                                           |
| use?                     |                                           |
+--------------------------+-------------------------------------------+
| 3b. If processes are     | Not applicable.                           |
| being consolidated, are  |                                           |
| the proper controls      |                                           |
| remaining in place to    |                                           |
| protect the data and     |                                           |
| prevent unauthorized     |                                           |
| access? Explain.         |                                           |
+--------------------------+-------------------------------------------+
| 4a. How will the data be | UMA browser views can searched by         |
| retrieved? Can it be     | Username by authorized administrators,    |
| retrieved by personal    |                                           |
| identifier? If yes,      |                                           |
| explain.                 |                                           |
+--------------------------+-------------------------------------------+
| 4b. What are the         | No potential effects have been            |
| potential effects on the | identified.                               |
| due process rights of    |                                           |
| customers and employees  |                                           |
| of:                      |                                           |
|                          |                                           |
| -   consolidation and    |                                           |
|     linkage of files and |                                           |
|     systems;             |                                           |
|                          |                                           |
| -   derivation of data   |                                           |
|                          |                                           |
| -   accelerated          |                                           |
|     information          |                                           |
|     processing and       |                                           |
|     decision making;     |                                           |
|                          |                                           |
| -   use of new           |                                           |
|     technologies.        |                                           |
+--------------------------+-------------------------------------------+
| 4c. How are the effects  | Not applicable.                           |
| to be mitigated?         |                                           |
+--------------------------+-------------------------------------------+
| ## Maintenance Of        |                                           |
|  Administrative Controls |                                           |
+--------------------------+-------------------------------------------+
| 1a. Explain how the      | Not applicable. Access to the system is   |
| system and its use will  | granted based upon a users defined role.  |
| ensure equitable         |                                           |
| treatment of customers   |                                           |
| and employees.           |                                           |
+--------------------------+-------------------------------------------+
| 2a. If the system is     | Not applicable. This is a single site     |
| operated in more than    | system.                                   |
| one site, how will       |                                           |
| consistent use of the    |                                           |
| system and data be       |                                           |
| maintained in all sites? |                                           |
+--------------------------+-------------------------------------------+

  --------------------------- -------------------------------------------
  2b. Explain any possibility Not applicable. See 2a.
  of disparate treatment of   
  individuals or groups.      

  2c. What are the retention  Retention periods have not been defined.
  periods of data in this     
  system?                     

  2d. What are the procedures No files or data have been eliminated. Data
  for eliminating the data at archiving processes are compliant with
  the end of the retention    Federal Regulations.
  period? Where are the       
  procedures documented?      

  2e. While the data is       Not applicable. System users and managers
  retained in the system,     determine these requirements based upon
  what are the requirements   predetermined and assigned roles.
  for determining if the data 
  is still sufficiently       
  accurate, relevant, timely, 
  and complete to ensure      
  fairness in making          
  determinations?             

  3a. Is the system using     No.
  technologies in ways that   
  the USDA has not previously 
  employed (e.g. Caller-ID)?  

  3b. How does the use of     Not applicable.
  this technology affect      
  customer/employee privacy?  

  4a. Will this system        No.
  provide the capability to   
  identify, locate, and       
  monitor individuals? If     
  yes, explain.               

  4b. Will this system        No.
  provide the capability to   
  identify, locate, and       
  monitor groups of people?   
  If yes, explain.            

  4c. What controls will be   Operating system auditing trails monitor
  used to prevent             the activities of administrators and
  unauthorized monitoring?    application transaction files record user
                              activity..
  --------------------------- -------------------------------------------

  --------------------------- -------------------------------------------
  5a. Under which Systems of  None.
  Record notice (SOR) does    
  the system operate? Provide 
  number and name.            

  5b. If the system is being  Not applicable.
  modified, will the SOR      
  require amendment or        
  revision? Explain.          
  --------------------------- -------------------------------------------