![](media/image1.png){width="6.875in" height="1.2333333333333334in"}

**PRIVACY IMPACT
ASSESSMENT**![](media/image2.png){width="2.170138888888889in"
height="0.35in"}

The Privacy Act of 1974, as Amended (5 United States Code 552a) and the
Computer Matching and Privacy Act of 1988 (Public Law 100-503) affords
individuals the right to privacy in records that are maintained and used
by Federal agencies. The Food and Nutrition Service (FNS) is responsible
for ensuring the privacy, confidentiality, integrity, and availability
of customer and employee information. The Privacy Impact Assessment
(PIA) is a process used to evaluate privacy in information systems. The
completed PIA is submitted to the Office of the Privacy Advocate for
review.

**Electronic Disqualified Recipient System (eDRS)**

eDRS will provide authorized users with a single, user-friendly and
web-based interface for accessing the most up-to-date and comprehensive
data on disqualified Food Stamp recipients. This system will centralize
and improve upon the earlier Disqualified Recipient System (DRS) system,
which was deployed in 1991 as the first available national database
system to support the collection and management of data on disqualified
recipients of Food Stamps throughout the United States. With the new
eDRS system, users can conveniently and securely access information from
their own personal computers (PCs) and can perform all necessary
functions related to disqualification data through one web site.

eDRS is categorized as a Major Application (MA) because it is a software
application supporting a specific mission-related function. eDRS stores,
processes, and transmits (i.e., handles) Disqualified Recipient data and
information that is important to USDA-FNS and state-level benefit
programs. The eDRS information handled, essential to USDA-FNS and state
programs, requires the special attention typical of information
categorized as "sensitive" because some eDRS information is personal
(i.e., Privacy Act), financial, and/or medical data. eDRS is a website
open to the public and does not require special user access. The eDRS MA
utilizing HP DL380 running Windows 2003 Enterprise server as the Web
server, The second HP DL380 running Windows 2003 Enterprise server and
Microsoft SQL server 2000 for database repository. Both servers are
connected to a Windows 2003 Active Directory Domain. In addition the
network is protected by Checkpoint NGX R60 firewall VPN-1 operating on a
HP server with High availability.

**I. Data in the System**

1.  ***Generally describe the information to be used in the system in
    each of the following categories: Customer, Employee, and Other:***

**[Customer]{.underline}**

-   The eDRS information handled, essential to USDA-FNS and state
    programs, requires the special attention typical of information
    categorized as "sensitive" because some eDRS information is personal
    (i.e., Privacy Act).

**[Employee]{.underline}**

-   eDRS stores, processes, and transmits (i.e., handles) Disqualified
    Recipient data (food stamps) and information that is important to
    USDA-FNS and state-level benefit programs.

2.  ***What are the sources of the information in the system?***

-   Disqualified Recipient data and information from USDA-FNS and state
    programs.

a.  ***What USDA files and databases are used? What is the source
    agency?***

-   The eDRS MA utilizing HP DL380 running Windows 2003 Enterprise
    server as the Web server, The second HP DL380 running Windows 2003
    Enterprise server and Microsoft SQL server 2000 for database
    repository. Both servers are connected to a Windows 2003 Active
    Directory Domain.

-   USDA state agencies are the source agency for all listed systems.

b.  ***What Federal Agencies are providing data for use in the
    system?***

> None.

c.  ***What State and Local Agencies are providing data for use in the
    system?***

> The eDRS system is the national repository for states use.

d.  ***From what other third party sources will data be collected?***

> None.

e.  ***What information will be collected from the customer/employee?***

> eDRS will require authorized users to provide access identification.

***3. a. How will data collected from sources other than the USDA
records and the customer be verified for accuracy?***

The eDRS system, does not reference external data sources.

b.  ***How will data be checked for completeness?***

Secondary verification: before any penalty or adverse action is taken,
the records must have supporting documents, verified.

> ***c. Is the data current? How do you know?***

With secondary verification, the FNS state agent must confirm the
supporting documentation.

4.  ***Are the data elements described in detail and documented? If yes,
    what is the name of the document?***

Yes, the hardcopy Form FNS-524 and Online data entry, have explanations
and definitions for all data elements.

[]{.mark}

**II. Access to the Data**

1.  ***Who will have access to the data in the system (Users, Managers,
    System Administrators, Developers, Other)?***

-   The primary users of the system are eDRS employees with a need to
    access the information. These users are segregated into five
    categories that will include the ISSO, system owners, project
    managers, system administrators, and users. These categories will be
    identified in writing for eDRS. The roles of security officer,
    system administrator and project manager shall not be shared; roles
    and responsibilities for each must be divided and clearly defined in
    position descriptions to prevent a single individual from subverting
    a critical process.

2.  ***How is access to the data by a user determined? Are criteria,
    procedures, controls, and responsibilities regarding access
    documented?***

Access to the system will follow FNS existing processes using the Form
FNS-674. The following mandatory rules are defined for users of FNS
computer and information systems:

-   Users are forbidden to access, research, or change any account,
    file, record, or application that is not required to perform
    official duties.

-   Users are restricted to accessing, researching or changing only
    accounts, files, records or applications required to perform their
    official duties.

-   If asked to access an account or other sensitive or private
    information, users are required to verify that the request is
    authorized and valid. Users will be held accountable if they access
    an unauthorized account.

-   Users are required to protect passwords from disclosure and to
    refuse acceptance of passwords that are not delivered in a sealed
    envelope. Users are required to log/sign off anytime they leave the
    computer or terminal.

-   Users are required to retrieve all hard copy printouts in a timely
    manner, ensure magnetic media is secured based on the sensitivity of
    the information contained, and practice proper labeling procedures.
    Users are instructed not to disclose or discuss any FNS-related
    information with unauthorized individuals.

-   All vendors are to be escorted and monitored.

-   Access to eDRS is accomplished through the Identification and
    Authorization (I&A) functions contained within the Microsoft Windows
    operating system.

-   The use of unlimited privilege is strictly limited and audited. An
    unlimited account has unlimited access to the operating system,
    affording access to all system administration and security
    functions. The FNS defines the responsibilities associated with
    these functions, and that information is provided to system vendors
    and developers.

-   The Windows operating system and the Database Management System
    (DBMS) security controls allow for resource-based access. Individual
    and group profiles have been established and system level file
    protection is implemented. UserIDs, groups, and resources are
    identified for protection. Permissions/profiles are identified for
    individuals, groups or users, nested resources, or multiple
    groups/nests, and can only be assigned by an authorized individual.

***3. Will users have access to all data on the system or will the
user's access be restricted? Explain.***

There are two types of eDRS users: 1) General User and 2) Administrator.
General users log into the eDRS application via the eAuthentication
website. General users have read/write access to certain data based upon
their location and access privileges. Administrators can view
everything, as well as create, update, and delete privileges for areas
of the eDRS based, again, upon location and access privileges as an
administrator.

eDRS access controls include:

-   eDRS does not allow public access. All users must have a unique
    eAuthentication ID and password to log into the application. Once
    logged in to eAuthentication, users can access the eDRS. The system
    users are authenticated using Microsoft Windows 2003 Active
    Directory.

-   The two types of eDRS users, the 1) General Users and 2)
    Administrators, have different privileges: General users can only
    view all eDRS data. Only administrators have additional privileges
    for creating, updating, and deleting eDRS data. CSAMS and authorized
    administrators can view user account information to grant access to
    users. This is performed through the CSAMS application.

-   eDRS has a disclaimer page. This page requires active
    acknowledgement by the user prior to accessing the eDRS.

-   After 3 invalid login attempts are user is locked out of the systems
    for 60 minutes.

-   User access rights are handled by the Windows 2003 Active Directory
    groups and permissions, and then ACLs are set on the directories and
    files that pertain to the application.

-   The application handles the application users separately from the
    operating system.

***4. What controls are in place to prevent the misuse (e.g., browsing)
of data by those having access?***

Users are restricted by their ID and location from accessing or browsing
data that is not within their area

***5.a. Do other systems share data or have access to data in this
system? If yes, explain.***

-   The eDRS database currently interfaces with the DRS mainframe system
    as well as state-level benefit systems.

-   A site to site VPN exists between eDRS and the DRS system is located
    at NITC.

-   A site to site VPN exists between eDRS and FNS HQ in Alexandria.

-   eDRS will replace DRS. The 2 systems will co-exist until DRS is
    retired (end of FY 2006).

***b. Who will be responsible for protecting the privacy rights of the
customers and employees affected by the interface?***

-   Protecting the privacy rights of the customers and employees
    affected by the interface is the responsibility of effective USDA
    and FNS security policies and enforcement.

***6. a. Will other agencies share data or have access to data in this
system (International, Federal, State, Local, Other)?***

> Other agencies do not share data or have access to data in this
> system.

b.  ***How will the data be used by the agency?***

> Other agencies do not share data or have access to data in this
> system.

c.  ***Who is responsible for assuring proper use of the data?***

> Other agencies do not share data or have access to data in this
> system.

III. **Attributes of the Data**

```{=html}
<!-- -->
```
1.  ***Is the use of the data both relevant and necessary to the purpose
    for which the system is being designed?***

> Yes, the use of the data is both relevant and necessary for the
> purpose for which eDRS was designed and for accomplishing the mission
> of FNS.

***2. a. Will the system derive new data or create previously
unavailable data about an individual through aggregation from the
information collected?***

> No, eDRS does not derive or create new data.

b.  ***Will the new data be placed in the individual's record (customer
    or employee)?***

> Not Applicable.

c.  ***Can the system make determinations about customers or employees
    that would not be possible without the new data?***

> Not Applicable.

d.  ***How will the new data be verified for relevance and accuracy?***

> Not Applicable.

***3. a. If data is being consolidated, what controls are in place to
protect the data from unauthorized access or use?***

Data is not being consolidated. Controls are in place to protect
existing data.

-   Physical access to the servers is protected by FNS policy and
    procedures.

-   Electronic access to the servers is protected by FNS/USDA firewalls
    and network security.

-   The application is protected by authorization and authentication at
    the application level.

-   Intrusion detection devices will monitor the servers that are
    available to the public.

b.  ***If processes are being consolidated, are the proper controls
    remaining in place to protect the data and prevent unauthorized
    access? Explain?***

> Not applicable. Processes are not being consolidated.
>
> ***4.a How will the data be retrieved? Can it be retrieved by personal
> identifier? If yes, explain.***
>
> The data will be retrieved by searches and reports based on various
> search criteria including personal identifiers. Searches and reports
> are developed by FNS employees for their workload management and
> supervision.

b.  ***What are the potential effects on the due process rights of
    customers and employees of:***

> There are no effects on customers and employees due process rights.
> eDRS is an information system that supports the administration of all
> FNS programs and is the official source for analysis, reporting and
> public release of Agency program participation and costs data.

c.  ***Consolidation and linkage of files and systems;***

> eDRS does not consolidate or link files or systems. eDRS provides a
> single, consistent, official database to support the analysis,
> reporting and public release of Agency program participation and costs
> data.

d.  ***Derivation of data**;*

> Not Applicable. There is no derivation of data.

e.  ***Accelerated information processing and decision making;***

> Not Applicable.

f.  ***Use of new technologies;***

> The eDRS configuration is not a new technology. eDRS utilizes the
> following technologies:

  -------------------- -------------- -----------------------------------------
  **Item**             **Quantity**   **Description**

  Processor:           2              3.2GHz/1MB Cache/533MHz FSB Xeon

  Memory:              1              1GB DDR SDRAM 266MHZ

  Hard Drive:          4              36GB 10K RPM Ultra 320 SCSI Hard Drive
                                      (RAID 5 configuration)

  Operating System:    1              Windows 2003 Server, Client Access
                                      Licenses English

  Floppy Disk Drive:   1              1.44MB,3.5 in, Floppy Drive

  NIC:                 1              Dual On-Board NICS ONLY

  CD-ROM or DVD-ROM    1              24X IDE Internal CD-ROM
  Drive:                              

  Software             1              IIS 6.0

                       1              .NET Framework, version 1.1
  -------------------- -------------- -----------------------------------------

  -------------------- -------------- -----------------------------------------
  **Item**             **Quantity**   **Description**

  Processor:           2              3.2GHz/1MB Cache/533MHz FSB Xeon

  Memory:              1              1GB DDR SDRAM 266MHZ

  Hard Drive:          4              36GB 10K RPM Ultra 320 SCSI Hard Drive
                                      (RAID 5 configuration)

  Operating System:    1              Windows 2003 Server, Client Access
                                      Licenses English

  Floppy Disk Drive:   1              1.44MB, 3.5 in, Floppy Drive

  NIC:                 1              Dual On-Board NICS ONLY

  CD-ROM or DVD-ROM    1              24X IDE Internal CD-ROM
  Drive:                              

  Software             1              MS SQL Server 2000 Standard Edition
  -------------------- -------------- -----------------------------------------

***5. How are the effects to be mitigated?***

> There are no effects to be mitigated.
>
> **IV. Maintenance of Administrative Controls**

***1. a. Explain how the system and its use will ensure equitable
treatment of customers and employees.***

> eDRS provides a single, consistent, official database to support
> analysis, reporting and public release of Agency program participation
> and costs data.
>
> ***b. If the system is operated in more than one site, how will
> consistent use of the system and data be maintained in all sites?***
>
> eDRS is installed and operated only at the American Systems Lorton, VA
> location.
>
> ***c. Explain any possibility of disparate treatment of individuals or
> groups.***
>
> Not Applicable.

***2. a. What are the retention periods of data in this system?***

> Data is retained on the active database, until a recipient reaches the
> age of 80 years, or the record is delete as a result of program
> procedure.
>
> ***b. What are the procedures for eliminating the data at the end of
> the retention period? Where are the procedures documented?***
>
> Records with a recipient age of 80 years, are reported to the states
> for removal. Deleted records are not archived.

c.  ***While the data is retained in the system, what are the
    requirements for determining if the data is still sufficiently
    accurate, relevant, timely, and complete to ensure fairness in
    making determinations?***

-   The data maintained in eDRS is transaction level data that has been
    reviewed and audited by the USDA Office of the Inspector General
    (OIG) on an annual basis.

***3. a. Is the system using technologies in ways that the FNS has not
previously employed (e.g., Caller-ID)?***

> The eDRS is not using technologies in ways that the FNS has not
> previously employed.

b.  ***How does the use of this technology affect customer/employee
    privacy?***

> Not Applicable.

***4. a. Will this system provide the capability to identify, locate,
and monitor individuals? If yes, explain***.

> eDRS does provide basic identifying information, which the state of
> record can use to identify, and locate individuals via its detail
> records. USDA can also use the system to monitor recipients activities
> in multiple states via its detail records.
>
> ***b. Will this system provide the capability to identify, locate, and
> monitor groups of people? If yes, explain.***
>
> eDRS does not provide the capability to identify, locate, and monitor
> groups of people.

c.  ***What controls will be used to prevent unauthorized monitoring?***

-   The eDRS application provides I&A controls, which include a unique
    identification (ID) and password for each authorized user. A new
    eDRS user registers by filling out an FNS-674 form. CSAMS personnel
    from USDA-FNS then grant access based on the user's organization
    after a user and password have been created for that user from
    eAuthentication. The authorized user can then log into the
    eAuthentication website using the user ID and initial password. The
    eDRS user is then able to log in to eDRS after successful login into
    eAuthentication. If an administrator or user leaves and/or is no
    longer authorized access, CSAMS personnel will inactivate the
    obsolete user account. Passwords are created using a random password
    generator and then Microsoft Windows 2003 Active Directory encrypts
    all passwords. Other operating systems mechanisms are also used such
    as disallowing dictionary attacks and forcing the use of complex
    passwords.

***5. a. Under which Systems of Record notice (SOR) does the system
operate? Provide number and name.***

> Under Food Stamp Program SOR.  USDA/FNS-5
>
> ***b. If the system is being modified, will the SOR require amendment
> or revision? Explain.***
>
> No, the SOR will not require amendment, because eDRS is the
> replacement system for DRS and will operate under the same SOR.