**National Oceanic and Atmospheric Administration (NOAA)**

![](media/image1.png){width="2.852777777777778in"
height="2.747916666666667in"}

**National Vessel Monitoring System**

**Privacy Impact Assessment Statement**

**August 2007**

**National Vessel Monitoring System**

**Privacy Impact Assessment Statement**

**Unique Project Identifier**: 006-48-01-14-02-3168-00

(NOAA 4050)

**Information Collections:** OMB 0648-0372, -0404, -0441, -0445, -0478,
-0519, -0544

**Project Description:**

The national Vessel Monitoring System (VMS) program provides near-real
time fishing vessel monitoring, control and surveillance throughout the
US Exclusive Economic Zone (EEZ), Pacific Ocean, and Atlantic Ocean.

For each monitored vessel, VMS provides, accurate to 100 meters, 365
days per year, 24 or more position reports per day (latitude and
longitude). This continuous monitoring supports the achievement of
compliance with regulations regarding open and closed seasons, closed
areas, international boundaries and obligations. It also provides
critical, life saving information to the Coast Guard in support of their
response in Search and Rescue (SAR) cases.

The VMS stores each vessel's unique identifier and location in an Oracle
database and displays the vessels on an electronic map using an
off-the-shelf surveillance application, SmartTRAC. The information
obtained through VMS is evidentiary in nature and used to prosecute
violations of fishery regulations in administrative and civil
proceedings.

**1. What information is to be collected (e.g., nature and source)?**

The VMS database contains data such as:

Vessel Name

Permit numbers

Permit types

Coast Guard Documentation numbers

State registration numbers

Position information (current and archived)

Unique Identifier of satellite transponder unit

Contact e-mail address and/or phone number

Satellite transponders aboard each vessel transmit the position reports
at given intervals, generally once an hour. Information received from
the vessels is matched with the vessel's registration data and the
satellite transponder's unique identifier. This ensures that each
position report is associated with the correct vessel. If there is any
question to the accuracy of the data, the transponder unit can be
removed from the vessel and tested for accuracy.

**2. Why is the information being collected (e.g., to determine
eligibility)?**

The information is collected for the purpose of ensuring compliance with
federal and regional fishery regulations developed to manage fisheries
and prevent over-fishing. The overall authority for federal fishery
management is the Magnuson-Stevens Conservation and Management Act (16
U.S. Code 1801), [as amended in
2006](http://www.nmfs.noaa.gov/msa2007/2007reauth_notsigned.pdf).
Federal regulations may be found at [50 CFR 300 and 50 CFR
600-697](http://www.gpoaccess.gov/cfr/).

**3. What is the intended use of the information (e.g., to verify
existing data)?**

The Vessel Monitoring System (VMS) helps ensure individual vessel
compliance with regional and federal fishing regulations through
transmitted position reports at given intervals. Vessel tracks can be
analyzed to indicate trends or patterns of suspicious or unusual
activity.

VMS is also used by the U.S. Coast Guard and other federal and
international law enforcement agencies to enforce other federal laws and
international treaties related to the prevention of over-fishing: the
High Seas Fishing Compliance Act, the American Fisheries Act, the
Atlantic Coastal Fisheries Cooperative Management Act, the Atlantic
Tunas Convention Authorization Act, the Northern Pacific Halibut Act and
the Antarctic Marine Living Resources Convention Act.

VMS data is also used by the [U.S. Coast Guard](http://www.uscg.mil/) in
coordinating Search and Rescue (SAR) operations in addition to their law
enforcement duties.

**4. With whom will the information be shared (e.g., another agency for
a specified programmatic purpose)?**

Internal - [NOAA Office for Law
Enforcement](http://www.nmfs.noaa.gov/ole/), the administrator of the
Vessel Monitoring System program. All data within the user's region is
displayed for the purpose of enforcing compliance with federal and
regional fishery regulations. The Office for Law Enforcement provides
users with training on how to properly use the Vessel Monitoring System,
as well as proper practices and procedures for handling sensitive
information.

External - The U.S. Coast Guard has a data feed with VMS. All
information is displayed for the vessels in a given region. This
information is used for law enforcement as well as search and rescue
activities. VMS data are secured by the U.S. Coast Guard in accordance
with U.S. Coast Guard regulations regarding the use and disclosure of
law enforcement sensitive data. U.S. Coast Guard personnel are trained
in the use of VMS and the handling and disclosure of data in accordance
with U.S. Coast Guard regulations.

**5. What opportunities do individuals have to decline to provide
information (i.e., where providing information is voluntary) or to
consent to particular uses of the information (other than required or
authorized uses), and how may individuals grant consent?**

Individuals who decline participation with this program are not eligible
for a commercial permit in the region or fishery that requires VMS.
Participation in the VMS program is a condition for holding or obtaining
a permit.

The information collected is used primarily for law enforcement
purposes. There is no public disclosure or access to this data or the
system. Individuals participating in this program have the option to
enter multiple contact methods in the vendor registration form
(secondary telephone number, secondary e-mail, etc.).

The name of the vessel owner can be retrieved from the applicable
fishery permit database when required by the Office of Law Enforcement
and/or the U.S. Coast Guard to investigate a possible violation.
Retrieving such information is listed as a "routine use" in the Privacy
Act Statement, which is in the process of being updated on all
Sustainable Fisheries permit forms. The list of routine uses refers to
instances in which information may need to be shared with another
federal agency.

**6. How will the information be secured (e.g., administrative and
technical controls)?**

*Management Controls:*

VMS contains law enforcement sensitive data. The loss of confidentiality
could compromise ongoing criminal investigations. For this reason,
encryption and closely managed user access were fully implemented in the
system. There is no public access to VMS. All network communication is
handled through a secure encrypted connection.

All user accounts are centrally managed through Microsoft Active
Directory, and are individually assigned on the basis of least privilege
(least privilege is the practice of granting the least amount of access
possible to a user while still allowing fulfillment of job
responsibilities). Accounts and access levels are created and managed
also through the principle of individual accountability, and through
periodic account audits.

Access is logged at the firewall level when the secure encrypted
connection is initiated, as well as when a user logs into the system.
Only users whose job requires access to the system can obtain a user
account. The procedures for obtaining an account are documented in the
System Security Plan.

*Operational Controls:*

The system is physically housed in an office building in Maryland. The
building is staffed by a contracted security guard five days a week
eight hours a day, and has existing physical security and fire
protection controls including uniformed guard service during business
and evening hours.

Physical access to VMS system hardware is restricted to authorized
staff. The local area network (LAN) and server rooms are secured with
access card doors. Access cards are provided only to VMS administrators
and IT personnel.

In the event an outside technician is required, the technician is
supervised and observed at all times by a member of the VMS IT Staff.

The system is housed in an area where appropriate environmental security
controls are implemented. Environmental concerns include hurricanes,
tornadoes, and lightning strikes. Precautions for these concerns are as
follows:

a\. The data is backed up at the end of each day and the backup tapes
are stored offsite.

b\. Compatible hardware such as hard drives and memory are maintained
for quick replacement.

c\. Computer servers and network equipment and software are
off-the-shelf and readily available through multiple sites (including
local sources).

d\. The computer room is located in an inner office to allow protection
from high winds, broken glass, and moisture.

e\. Servers are all connected to uninterruptible power supplies

f\. A fire extinguisher is located in the computer room.

*Technical Controls:*

Only system administrators have full access to the system. All other
users have read-only access. Access is assigned based on the principle
of least privilege.

All user accounts are centrally managed through Microsoft Active
Directory.

Account and access level information are manually verified upon creation
by the system administrator, based upon the user's roles and
responsibilities.

System Administrators and IT staff are granted access according to their
specific responsibilities. Each user within VMS has a unique account.
The access level of each account is dependent upon the user's role
within the system as well as his or her job responsibilities. The system
owner and network administrator assign duties and responsibilities.

System privileges are assigned by the network administrator or system
owner based on the individual\'s job requirements and the principle of
least privilege. Privileges are limited to only those necessary for job
requirements. Each user has an individual account assigned to him or
her, providing accountability in the event of unauthorized system
activity.

VMS data is secured in compliance with the requirements of the [Federal
Information Security Act of
2002](http://www4.law.cornell.edu/uscode/html/uscode44/usc_sec_44_00003541----000-.html)
(FISMA). A Security Certification and Accreditation (C&A) was completed
for this system in June 2007. The C&A process is an audit of policies,
procedures, controls, and contingency planning, required to be completed
for all Federal Government IT systems every three years.

**7. Is a system of records being created under the Privacy Act, 5
U.S.C. 552a?**

No. Although it includes some personal information (e-mail addresses and
phone numbers), the primary method of reference or data retrieval is by
vessel name, not by personally identifiable information, and thus it is
not a system of records as defined by the Privacy Act.

**8. How long are these records retained?  The response should include
the retention period and the applicable records controls schedule.  If
there is not a records schedule, the response should so indicate.**

A schedule for the disposition of these records has not yet been
approved by the National Archives and Records Administration (NARA). A
schedule is being developed and is expected to be approved by NARA no
later than September 30, 2009. Pending approval of a records schedule,
VMS records are not authorized for disposal and must be retained.

**Contact:** Eric Barton, VMS Plans and Programs

Ph: (301) 495-7110 or <eric.barton@noaa.gov>.