![](media/image1.wmf)

######### PRIVACY IMPACT ASSESSMENT

######### E-Travel Initiative:

#########  Carlson Wagonlit Government Travel

######### E2 Solutions

######## 

######## August 31, 2004

#### A. Data in the System

+---------------------------+------------------------------------------+
| 1\. Describe all          | *a.* eTravel Service (eTS) is an         |
| information to be         | "end-to-end" web-based travel management |
| included in the system,   | service that enables travelers and/or    |
| including personal data.  | travel arrangers to plan and make        |
|                           | reservations (air, rail, lodging, car    |
|                           | rental, etc.) on-line, prepare travel    |
|                           | authorizations and vouchers on-line, and |
|                           | produce itineraries, have tickets        |
|                           | issued, and obtain receipts on-line. The |
|                           | Travel Authorization and Voucher System  |
|                           | (TAVS) is an integral part of eTS,       |
|                           | allowing split payments, i.e., EFT       |
|                           | payments to the official travel charge   |
|                           | card vendor as well as reimbursement to  |
|                           | the traveler.                            |
|                           |                                          |
|                           | A traveler registers to become a user of |
|                           | eTS, providing identifying information   |
|                           | such as name and password, and completes |
|                           | a profile with personal information,     |
|                           | including social security number, home   |
|                           | address, home telephone number, travel   |
|                           | preferences, frequent flyer and rental   |
|                           | car club account numbers, passport       |
|                           | information, emergency contact name,     |
|                           | address, and telephone number, personal  |
|                           | credit card number (official travel      |
|                           | charge card account at a minimum), and   |
|                           | other information as required by the     |
|                           | agency's TAVS, Travel Management Center  |
|                           | (TMC), and transportation providers for  |
|                           | making reservations and issuing tickets. |
|                           |                                          |
|                           | b\. Name, SSN, UserID, home address,     |
|                           | home and office email, home and office   |
|                           | telephone numbers, current passport      |
|                           | and/or visa number(s), credit card       |
|                           | numbers and related information; bank    |
|                           | account information needed for           |
|                           | electronic funds transfer; frequent      |
|                           | traveler account information; travel     |
|                           | claim information; destinations; and     |
|                           | individual charges and balances. In      |
|                           | addition, other passport information     |
|                           | (i.e. issuing country, expiration date), |
|                           | and emergency contact information are    |
|                           | included.                                |
+---------------------------+------------------------------------------+
| 1.a. What stage of the    | Implementation                           |
| life cycle is the system  |                                          |
| currently in?             |                                          |
+---------------------------+------------------------------------------+
| 2.a. What are the sources | All traveler profile data will be        |
| of the information in the | entered by the traveler, or by an        |
| system?                   | authorized travel arranger with the      |
|                           | permission of the traveler. TAVS data    |
|                           | will be entered by the traveler, by the  |
|                           | travel arranger, or in some instances by |
|                           | the System Administrator.                |
|                           |                                          |
|                           | In addition, there may be an initial     |
|                           | upload and periodic updates of           |
|                           | financial, HR, and travel card account   |
|                           | data, to permit proper Electronic Fund   |
|                           | Transfer (EFT) payments to the travel    |
|                           | card vendor and to the traveler.         |
|                           |                                          |
|                           | The privacy information is entered by    |
|                           | the user, entered on behalf of the user, |
|                           | or comes programmatically from another   |
|                           | system                                   |
+---------------------------+------------------------------------------+
| 2.b. What GSA files and   | GSA databases containing information     |
| databases are used?       | relating to master contracts for eTS may |
|                           | be used.                                 |
+---------------------------+------------------------------------------+
| 2.c. What Federal         | Federal agencies with task orders issued |
| agencies are providing    | under GSA's master contracts for eTS     |
| data for use in the       | provide data for users in the system.    |
| system?                   | There may be initial uploads and         |
|                           | periodic updates of data from financial  |
|                           | and HR systems of participating Federal  |
|                           | agencies.                                |
+---------------------------+------------------------------------------+
| 2.d. What State and local | None***.***                              |
| agencies are providing    |                                          |
| data for use in the       |                                          |
| system?                   |                                          |
+---------------------------+------------------------------------------+
| 2.e. What other third     | Credit card companies. Other possible    |
| party sources will the    | sources are the Travel Management        |
| data be collected from?   | Centers (TMC), hotels, car rental        |
|                           | companies, and airlines.                 |
+---------------------------+------------------------------------------+
| 2.f. What information     | Name, SSN, UserID, home address, home    |
| will be collected from    | and office email, home and office        |
| the individual whose      | telephone numbers, current passport      |
| record is in the system?  | and/or visa number(s), credit card       |
|                           | numbers and related information; bank    |
|                           | account information needed for           |
|                           | electronic funds transfer; frequent      |
|                           | traveler account information; travel     |
|                           | claim information; destinations;         |
|                           | individual charges and balances, and     |
|                           | agency-specified TAVS information and    |
|                           | other accounting data. Other information |
|                           | gathered is emergency contact            |
|                           | information, and additional passport     |
|                           | information.                             |
|                           |                                          |
|                           | Additional information may be entered at |
|                           | the traveler's option for enhanced       |
|                           | service, such as air, hotel, and car     |
|                           | rental preferences, and frequent         |
|                           | traveler or club membership numbers.     |
|                           |                                          |
|                           | When travel arrangements are made, the   |
|                           | following information is entered: travel |
|                           | dates and times, departure and arrival   |
|                           | cities and airports or terminals,        |
|                           | airline flight or train tickets          |
|                           | reserved, hotel reservations, and car    |
|                           | rentals reserved. Also entered are any   |
|                           | special requests or accommodations       |
|                           | required.                                |
+---------------------------+------------------------------------------+
| 3.a. How will the data    | The traveler or travel arranger will     |
| collected from sources    | verify the accuracy of all               |
| other than Federal agency | employee-entered TAVS data, traveler     |
| records or the individual | profile data, and reservation data. In   |
| be verified for accuracy? | addition, the fulfillment center which   |
|                           | issues tickets, typically a TMC, will    |
|                           | verify that reservation data are         |
|                           | consistent, i.e., that airline tickets,  |
|                           | rental cars, and hotel reservations are  |
|                           | coordinated and separate hotel and/or    |
|                           | car rental reservations do not overlap.  |
|                           |                                          |
|                           | The System Administrator will assure     |
|                           | that agency data, e.g., default          |
|                           | accounting data, official travel card    |
|                           | vendor payment data, etc., are current   |
|                           | and accurate.                            |
+---------------------------+------------------------------------------+
| 3.b. How will data be     | The on-line system will automatically    |
| checked for completeness? | check profile data for completeness,     |
|                           | prompting the individual entering data   |
|                           | when required fields are not completed.  |
|                           |                                          |
|                           | The traveler or travel arranger will     |
|                           | check reservation data for completeness. |
|                           | The on-line booking engine will prompt   |
|                           | the individual entering reservation data |
|                           | to enter air, rental car, and hotel      |
|                           | reservations, but the automated system   |
|                           | will not know whether a traveler         |
|                           | requires a hotel room or intends to stay |
|                           | with friends or relatives, it will not   |
|                           | know whether a rental car is required,   |
|                           | etc. Therefore, it is ultimately the     |
|                           | traveler's responsibility to assure that |
|                           | reservations are complete and accurate.  |
|                           |                                          |
|                           | TAVS data unrelated to individual trips, |
|                           | once entered, will rarely change. It     |
|                           | will be the traveler's or travel         |
|                           | arranger's responsibility to assure that |
|                           | the data are complete; else payment will |
|                           | likely not be accomplished.              |
+---------------------------+------------------------------------------+
| 3.c. Is the data current? | The traveler and travel arranger may     |
| How do you know?          | review and change profile data at any    |
|                           | time, and it is the traveler's           |
|                           | responsibility to assure that all        |
|                           | profile data are current.                |
|                           |                                          |
|                           | Reservation data are current because the |
|                           | on-line system is a real-time booking    |
|                           | engine that provides confirmation        |
|                           | numbers at session's end.                |
|                           |                                          |
|                           | If a traveler changes location within    |
|                           | the agency, certain TAVS data (primarily |
|                           | accounting data) may change, and the     |
|                           | traveler, travel arranger, or System     |
|                           | Administrator must make the necessary    |
|                           | changes at that time.                    |
+---------------------------+------------------------------------------+
| 4\. Are the data elements | The data elements required for making    |
| described in detail and   | reservations are described and           |
| documented? If yes, what  | documented in the "Help" feature of the  |
| is the name of the        | on-line profile and booking engine       |
| document?                 | systems. All data elements, including    |
|                           | TAVS requirements as well as on-line     |
|                           | booking data, are also included in the   |
|                           | System Administrator Guide.              |
+---------------------------+------------------------------------------+

####### B. Access to the Data

+-------------------------+--------------------------------------------+
| 1\. a. Who will have    | Access to an individual's TAVS, profile,   |
| access to the data in   | and reservation data will be available to  |
| the system?             | the traveler and to the travel arranger.   |
|                         | No traveler will have access to another    |
|                         | traveler's data, and travel arrangers will |
|                         | have access only to the data of those      |
|                         | travelers whom they have been authorized   |
|                         | to assist. The Federal Supervisory         |
|                         | Traveler Approver (FSTA) and the Federal   |
|                         | Financial Travel Approver (FFTA) will have |
|                         | access only to the data of those travelers |
|                         | whom they have been authorized to approve. |
|                         |                                            |
|                         | The Carlson eGov Solution's Lightweight    |
|                         | Directory Access Protocol (LDAP) and       |
|                         | application security implementation        |
|                         | provides end-to-end security management    |
|                         | services including management of           |
|                         | privileges and access control lists. Their |
|                         | application ensures availability,          |
|                         | integrity, confidentiality, and            |
|                         | nonrepudiation by providing internal user  |
|                         | identity management, authentication,       |
|                         | digital signature, and authorization       |
|                         | services.                                  |
|                         |                                            |
|                         | The E2 Solutions authorization process     |
|                         | employs discrete role-based access control |
|                         | throughout the application. Security is    |
|                         | provided at both the functional level      |
|                         | (does the user have access to this piece   |
|                         | of functionality -- Functional Security    |
|                         | Framework) and at the data level (does the |
|                         | user have access to this piece of data --  |
|                         | Data Level Security Framework).            |
|                         | Authorization is granted via the LDAP and  |
|                         | application security mechanism.            |
|                         |                                            |
|                         | Access to all individuals' TAVS, profile,  |
|                         | and reservation data will be available to  |
|                         | Federal agency travel managers and the     |
|                         | System Administrator. The profile and      |
|                         | reservation data only will be available to |
|                         | the servicing TMC on a need-to-know basis. |
|                         | The TMC and airlines, hotels, and rental   |
|                         | car providers will receive system output   |
|                         | for reservation, confirmation, and         |
|                         | ticketing actions.                         |
|                         |                                            |
|                         | In addition, the System of Records         |
|                         | stipulates that information in the system  |
|                         | may be disclosed as a routine use as       |
|                         | follows:                                   |
|                         |                                            |
|                         | a\. To a Federal, State, local, or foreign |
|                         | agency responsible for investigating,      |
|                         | prosecuting, enforcing, or carrying out a  |
|                         | statute, rule, regulation, or order, where |
|                         | agencies become aware of a violation or    |
|                         | potential violation of civil or criminal   |
|                         | law or regulation.\                        |
|                         | \                                          |
|                         | b. To another Federal agency or a court    |
|                         | when the Federal government is party to a  |
|                         | judicial proceeding.\                      |
|                         | \                                          |
|                         | c. To a Member of Congress or a            |
|                         | congressional staff member in response to  |
|                         | an inquiry from that congressional office  |
|                         | made at the request of the individual who  |
|                         | is the subject of the record.\             |
|                         | \                                          |
|                         | d. To a Federal agency employee, expert,   |
|                         | consultant, or contractor in performing a  |
|                         | Federal duty for purposes of authorizing,  |
|                         | arranging, and/or claiming reimbursement   |
|                         | for official travel, including, but not    |
|                         | limited to, traveler profile information.\ |
|                         | \                                          |
|                         | e. To a credit card company for billing    |
|                         | purposes, including collection of past due |
|                         | amounts.                                   |
|                         |                                            |
|                         | f\. To a Federal agency for accumulating   |
|                         | reporting data and monitoring the system.\ |
|                         | \                                          |
|                         | g. To a Federal agency by the contractor   |
|                         | in the form of itemized statements or      |
|                         | invoices, and reports of all transactions, |
|                         | including refunds and adjustments to       |
|                         | enable audits of charges to the Federal    |
|                         | government.                                |
|                         |                                            |
|                         | h\. To a Federal agency, in response to    |
|                         | its request, in connection with the hiring |
|                         | or retention of any employee to the extent |
|                         | that the information is relevant and       |
|                         | necessary to the requesting agency\'s      |
|                         | decision on the matter.\                   |
|                         | \                                          |
|                         | i. To an authorized appeal or grievance    |
|                         | examiner, formal complaints examiner,      |
|                         | equal employment opportunity investigator, |
|                         | arbitrator, or other duly authorized       |
|                         | official engaged in investigation or       |
|                         | settlement of a grievance, complaint, or   |
|                         | appeal filed by an employee to whom the    |
|                         | information pertains.\                     |
|                         | \                                          |
|                         | j. To the Office of Personnel Management   |
|                         | (OPM) in accordance with the agency\'s     |
|                         | responsibility for evaluation of Federal   |
|                         | personnel management.\                     |
|                         | \                                          |
|                         | k. To officials of labor organizations     |
|                         | recognized under 5 U.S.C. chapter 71 when  |
|                         | relevant and necessary to their duties of  |
|                         | exclusive representation concerning        |
|                         | personnel policies, practices, and matters |
|                         | affecting working conditions.\             |
|                         | \                                          |
|                         | l. To a travel services provider for       |
|                         | billing and refund purposes.\              |
|                         | \                                          |
|                         | m. To a carrier or an insurer for          |
|                         | settlement of an employee claim for loss   |
|                         | of or damage to personal property incident |
|                         | to service under 31 U.S.C. § 3721, or to a |
|                         | party involved in a tort claim against the |
|                         | Federal government resulting from an       |
|                         | accident involving a traveler.             |
|                         |                                            |
|                         | n\. To a credit reporting agency or credit |
|                         | bureau, as allowed and authorized by law,  |
|                         | for the purpose of adding to a credit      |
|                         | history file when it has been determined   |
|                         | that an individual\'s account with a       |
|                         | creditor with input to the system is       |
|                         | delinquent.                                |
+-------------------------+--------------------------------------------+
| 1.b. Is any of the data | Yes. A good number of the records will     |
| subject to exclusion    | contain personally identifiable            |
| from disclosure under   | information (PII). Records containing      |
| the Freedom of          | personal information may be considered     |
| Information Act (FOIA)? | "personal records" rather than "agency     |
| If yes, explain the     | records" with an agency. An agency will    |
| policy and rationale    | need to determine what the file was        |
| supporting this         | created for and the nature of the file.    |
| decision.               |                                            |
+-------------------------+--------------------------------------------+
| 2\. How is access to    | The System Administrator sets user access  |
| the data by a user      | levels based on agency sensitivity         |
| determined? Are         | requirements. Criteria, procedures,        |
| criteria, procedures,   | controls, and responsibilities regarding   |
| controls, and           | access are outlined in the System          |
| responsibilities        | Administrator's Guide.                     |
| regarding access        |                                            |
| documented?             | Federal travelers, managers, and System    |
|                         | Administrators will access the on-line     |
|                         | system through a secure 128-bit SSL        |
|                         | (secure socket layer) encrypted Internet   |
|                         | connection. System safeguards include      |
|                         | forced logout, system time-out, password   |
|                         | expiration, IP address validation, and     |
|                         | lockout after a specific number of failed  |
|                         | login attempts. These safeguards can be    |
|                         | enabled and controlled by the System       |
|                         | Administrator, and are configurable at the |
|                         | agency level and can be customized to meet |
|                         | the Federal agency's needs.                |
+-------------------------+--------------------------------------------+
| 3\. Will users have     | Traveler access is restricted to that      |
| access to all data in   | individual's own TAVS, profile, and        |
| the system or will the  | reservation data, as well as general       |
| user\'s access be       | non-personal reservation and system-use    |
| restricted? Explain.    | information. A travel arranger designated  |
|                         | by the traveler also has access to the     |
|                         | traveler's TAVS, profile, and/or           |
|                         | reservation data, when given the proper    |
|                         | permissions. Likewise, the Federal         |
|                         | Supervisory Travel Approver (FSTA) and the |
|                         | Federal Financial Travel Approver (FFTA)   |
|                         | can only access data that they are give    |
|                         | access to on a need-to-know basis. Each    |
|                         | agency will determine what the policies    |
|                         | and procedures will be for giving all      |
|                         | individuals access, and how/when the       |
|                         | access control lists are established,      |
|                         | reviewed and modified.                     |
|                         |                                            |
|                         | In general, access to data is given on a   |
|                         | need-to-know basis. The agency will        |
|                         | determine the access level based on this   |
|                         | need-to-know. The approver will have       |
|                         | access to some data but not all data, and  |
|                         | this right to use/see specific data will   |
|                         | be determined by the agency's policies and |
|                         | procedures and the access control          |
|                         | (permission) granted to see the            |
|                         | appropriate information.                   |
|                         |                                            |
|                         | Designated Agency-wide System              |
|                         | Administrators will have access for the    |
|                         | purpose of adding or deleting users,       |
|                         | resetting passwords, setting up            |
|                         | individuals as travel arrangers to make    |
|                         | travel reservations on another             |
|                         | individual's behalf, or changing group     |
|                         | profiles.                                  |
|                         |                                            |
|                         | CWGT System Administrators will be         |
|                         | responsible for backing up the data in a   |
|                         | secure manner and storing the backup data  |
|                         | in a secure location. Specific policies    |
|                         | will be in place ensuring authorized       |
|                         | access to backup media.                    |
|                         |                                            |
|                         | Federal agency travel managers will have   |
|                         | access to the system for accumulating      |
|                         | reporting data and monitoring the system.  |
|                         |                                            |
|                         | Agency-wide System Administrators will     |
|                         | have access to all users and group         |
|                         | profiles for their specific agency. They   |
|                         | will build and maintain travel policy      |
|                         | guidelines in the agency settings.         |
+-------------------------+--------------------------------------------+
| 4\. What controls are   | The System Administrator can configure the |
| in place to prevent the | on-line system to provide e-mail           |
| misuse (e.g. browsing)  | notification of individual and group       |
| of data by those having | profile updates, so that any changes made  |
| access?                 | will be known by affected users.           |
|                         |                                            |
|                         | To help protect against misuse of the      |
|                         | system and the data contained within the   |
|                         | system, all personnel are expected to read |
|                         | and acknowledge the Rules of Behavior      |
|                         | before being granted access to the system. |
|                         | In addition, there are technology          |
|                         | controls, such as auditing in place, which |
|                         | will reveal misuse of data in a timely     |
|                         | manner.                                    |
|                         |                                            |
|                         | Access control is given by the             |
|                         | administrator on a need-to-know basis.     |
|                         | These are periodically reviewed and        |
|                         | updated. Logs are audited for              |
|                         | inappropriate or unauthorized activity.    |
|                         |                                            |
|                         | Credit card numbers that are stored in the |
|                         | profiles cannot be viewed---the numbers    |
|                         | are masked (X'd) out except for the last   |
|                         | four digits. Obligation and payment data   |
|                         | may be changed only by authorized users,   |
|                         | i.e., the traveler, travel arranger,       |
|                         | System Administrator, or TAVS approving    |
|                         | officials.                                 |
|                         |                                            |
|                         | Auditing controls are required as part of  |
|                         | the eTS. The E2 System provides a robust   |
|                         | set of audit capabilities which can be     |
|                         | tailored to the policies and needs of each |
|                         | individual customer agency. As a result,   |
|                         | the E2 System provides the ability to      |
|                         | trace activities of any single individual, |
|                         | to include systems administrators, back to |
|                         | a single individual through their account  |
|                         | identity. These activities include input,  |
|                         | correction, amendment, cancellation and    |
|                         | approval.                                  |
+-------------------------+--------------------------------------------+
| 5.a. Do other systems   | Federal agency accounting systems will     |
| share data or have      | interface with the TAVS component of eTS   |
| access to data in this  | for proper recording of obligations when   |
| system? If yes,         | travel authorizations are approved, and    |
| explain.                | for recording expenses when voucher        |
|                         | payments are made. (Data will be passed    |
|                         | between systems. The agency accounting     |
|                         | systems will not have direct access to eTS |
|                         | databases.)                                |
|                         |                                            |
|                         | The Travel Management Center (TMC) will    |
|                         | have access to the profile and reservation |
|                         | data input by the traveler. This access is |
|                         | necessary for the TMC to complete          |
|                         | reservation and ticketing actions.         |
|                         |                                            |
|                         | The on-line booking engine directs         |
|                         | reservations to the TMC for fulfillment,   |
|                         | i.e., ticketing for transportation and     |
|                         | confirmation of hotel and/or car           |
|                         | reservations. The reservation systems, or  |
|                         | Global Distribution Systems (GDS), provide |
|                         | the link between the on-line booking       |
|                         | engine and the TMC.                        |
+-------------------------+--------------------------------------------+
| 5.b. Who will be        | Bill Hearne, CWGT ISSO, is responsible for |
| responsible for         | assuring that the agency has the access    |
| protecting the privacy  | controls in place within the system. The   |
| rights of the clients   | agency is responsible for assuring that    |
| and employees affected  | the data is properly used. The agency      |
| by the interface?       | should have Policies in place which are    |
|                         | enforced and protect the data against      |
|                         | misuse, and each user should be give and   |
|                         | sign The Rules of Behavior". The TMC       |
|                         | Master Contracts include FAR 52.224-2,     |
|                         | Privacy Act Notification (APR 1984) and    |
|                         | FAR 52.224-2, Privacy Act (APR 1984)       |
+-------------------------+--------------------------------------------+
| 6.a. Will other         | No agency will share data nor have free    |
| agencies share data or  | access to another agency's data in eTS,    |
| have access to data in  | but data may be provided to other agencies |
| this system             | in accordance with the *"Routine uses of   |
| (International,         | records..."* section in System of Records, |
| Federal, State, Local,  | Contracted Travel Services Program:        |
| Other)?                 | GSA/GOVT-4.                                |
+-------------------------+--------------------------------------------+
| 6.b. How will the data  | The agency will use this data to complete  |
| be used by the agency?  | travel arrangements end-to-end. The data   |
|                         | will be used to make travel reservations,  |
|                         | produce a voucher for payment, and update  |
|                         | the financial system and possible          |
|                         | interface with the Human Resource System.  |
|                         |                                            |
|                         | They can use the data to provide           |
|                         | statistics on many areas, provide the      |
|                         | average length of trips, and designate     |
|                         | obligated money, to mention a few of the   |
|                         | uses for the data.                         |
|                         |                                            |
|                         | The *"Routine uses of records..."* section |
|                         | in System of Records, Contracted Travel    |
|                         | Services Program: GSA/GOVT-4 states:       |
|                         |                                            |
|                         | Information in the system may be disclosed |
|                         | as a routine use as follows:\              |
|                         | \                                          |
|                         | a. To a Federal, State, local, or foreign  |
|                         | agency responsible for investigating,      |
|                         | prosecuting, enforcing, or carrying out a  |
|                         | statute, rule, regulation, or order, where |
|                         | agencies become aware of a violation or    |
|                         | potential violation of civil or criminal   |
|                         | law or regulation.\                        |
|                         | \                                          |
|                         | b. To another Federal agency or a court    |
|                         | when the Federal government is party to a  |
|                         | judicial proceeding.\                      |
|                         | \                                          |
|                         | c. To a Member of Congress or a            |
|                         | congressional staff member in response to  |
|                         | an inquiry from that congressional office  |
|                         | made at the request of the individual who  |
|                         | is the subject of the record.\             |
|                         | \                                          |
|                         | d. To a Federal agency employee, expert,   |
|                         | consultant, or contractor in performing a  |
|                         | Federal duty for purposes of authorizing,  |
|                         | arranging, and/or claiming reimbursement   |
|                         | for official travel, including, but not    |
|                         | limited to, traveler profile information.\ |
|                         | \                                          |
|                         | e. To a credit card company for billing    |
|                         | purposes, including collection of past due |
|                         | amounts.\                                  |
|                         | \                                          |
|                         | f. To a Federal agency for accumulating    |
|                         | reporting data and monitoring the system.  |
|                         |                                            |
|                         | g\. To a Federal agency by the contractor  |
|                         | in the form of itemized statements or      |
|                         | invoices, and reports of all transactions, |
|                         | including refunds and adjustments to       |
|                         | enable audits of charges to the Federal    |
|                         | government.                                |
|                         |                                            |
|                         | h\. To a Federal agency, in response to    |
|                         | its request, in connection with the hiring |
|                         | or retention of any employee to the extent |
|                         | that the information is relevant and       |
|                         | necessary to the requesting agency\'s      |
|                         | decision on the matter.                    |
|                         |                                            |
|                         | i\. To an authorized appeal or grievance   |
|                         | examiner, formal complaints examiner,      |
|                         | equal employment opportunity investigator, |
|                         | arbitrator, or other duly authorized       |
|                         | official engaged in investigation or       |
|                         | settlement of a grievance, complaint, or   |
|                         | appeal filed by an employee to whom the    |
|                         | information pertains.\                     |
|                         | \                                          |
|                         | j. To the Office of Personnel Management   |
|                         | (OPM) in accordance with the agency\'s     |
|                         | responsibility for evaluation of Federal   |
|                         | personnel management.\                     |
|                         | \                                          |
|                         | k. To officials of labor organizations     |
|                         | recognized under 5 U.S.C. chapter 71 when  |
|                         | relevant and necessary to their duties of  |
|                         | exclusive representation concerning        |
|                         | personnel policies, practices, and matters |
|                         | affecting working conditions.\             |
|                         | \                                          |
|                         | l. To a travel services provider for       |
|                         | billing and refund purposes.\              |
|                         | \                                          |
|                         | m. To a carrier or an insurer for          |
|                         | settlement of an employee claim for loss   |
|                         | of or damage to personal property incident |
|                         | to service under 31 U.S.C. § 3721, or to a |
|                         | party involved in a tort claim against the |
|                         | Federal government resulting from an       |
|                         | accident involving a traveler.             |
|                         |                                            |
|                         | n\. To a credit reporting agency or credit |
|                         | bureau, as allowed and authorized by law,  |
|                         | for the purpose of adding to a credit      |
|                         | history file when it has been determined   |
|                         | that an individual\'s account with a       |
|                         | creditor with input to the system is       |
|                         | delinquent.                                |
+-------------------------+--------------------------------------------+
| 6.c. Who is responsible | The CWGT ISSO is responsible for assuring  |
| for assuring proper use | that the agency has applied the access.    |
| of the data?            | Agency management and System               |
|                         | Administrators are responsible for         |
|                         | assuring proper use of the data within the |
|                         | agency. Security and auditing controls     |
|                         | will be implemented to prevent or identify |
|                         | unauthorized access to data.               |
+-------------------------+--------------------------------------------+
| 6.d. How will the       | System login, passwords, and SSL are in    |
| system ensure that      | place to protect the data and prevent      |
| agencies only get the   | unauthorized access. Security controls     |
| information they are    | will be placed on the data to allow        |
| entitled to?            | "need-to-know" access only. To initiate    |
|                         | any travel process, travelers access the   |
|                         | on-line system via the Internet and login  |
|                         | using an agency name, login name, and      |
|                         | user-defined password. They will be        |
|                         | required to be authenticated to the system |
|                         | via an accepted authentication mechanism.  |
|                         | With a valid login, the system presents    |
|                         | travelers with a menu of options, which    |
|                         | System Administrators customize according  |
|                         | to agency policies, the traveler's level   |
|                         | of expertise, job position, and/or travel  |
|                         | grouping.                                  |
|                         |                                            |
|                         | In addition, IV&V testing was performed to |
|                         | test access and ensure that data was not   |
|                         | accessed by anyone other than the one who  |
|                         | had access based on the eTS roles.         |
|                         |                                            |
|                         | The system protects the confidentiality of |
|                         | data in storage by requiring all users to  |
|                         | identify and authenticate themselves to    |
|                         | the system through the use of unique       |
|                         | UserIDs and passwords before gaining       |
|                         | access to any sensitive information; each  |
|                         | UserID is in turn mapped to roles and      |
|                         | associated access permissions within the   |
|                         | system. All passwords are stored in        |
|                         | encrypted form using operating-system      |
|                         | level FIPS 140-2 compliant cryptographic   |
|                         | one-way hash mechanisms.                   |
|                         |                                            |
|                         | In transit, the system protects the        |
|                         | confidentiality (and integrity) of data    |
|                         | through the application of FIPS 140-2      |
|                         | compliant commercial SSL which relies on a |
|                         | 128-bit cryptographic key.                 |
|                         |                                            |
|                         | Other agencies may obtain data from the    |
|                         | system only by submitting a request for    |
|                         | specific information to the agency which   |
|                         | "owns" the data.                           |
+-------------------------+--------------------------------------------+
| 7\. What is the life    | []{.mark}                                  |
| expectancy of the data? |                                            |
|                         | The data will be used, processed and then  |
|                         | stored. Data will be stored for six years  |
|                         | three months; this is specified by the     |
|                         | National Archives and Records              |
|                         | Administration (NARA) and with the CWGT    |
|                         | contract. The contract stipulates: "The    |
|                         | eTS should provide online access to        |
|                         | detailed transaction information for a     |
|                         | minimum period of 36 months, and permit    |
|                         | access to archived detailed transaction    |
|                         | information for a period of 6 years and 3  |
|                         | months."                                   |
|                         |                                            |
|                         | NARA guidelines regarding records          |
|                         | disposition are to be followed. As         |
|                         | specified in the contract "The eTS shall   |
|                         | prevent the purging of historical records  |
|                         | prior to the proper retention period, and  |
|                         | permit purging only of those records       |
|                         | authorized for disposal by the National    |
|                         | Archives and Records Administration (NARA) |
|                         | per 36 CFR 1228 and 1234. NARA General     |
|                         | Records Schedule 9 for Travel and          |
|                         | Transportation Records and General Records |
|                         | Schedule 20 for Electronic Records shall   |
|                         | apply."                                    |
+-------------------------+--------------------------------------------+
| 8\. How will the data   | NARA guidelines regarding records          |
| be disposed of when it  | disposition are to be followed. As         |
| is no longer needed?    | specified in the contract, "The eTS shall  |
|                         | prevent the purging of historical records  |
|                         | prior to the proper retention period, and  |
|                         | permit purging only of those records       |
|                         | authorized for disposal by the National    |
|                         | Archives and Records Administration (NARA) |
|                         | per 36 CFR 1228 and 1234. NARA General     |
|                         | Records Schedule 9 for Travel and          |
|                         | Transportation Records and General Records |
|                         | Schedule 20 for Electronic Records shall   |
|                         | apply."                                    |
+-------------------------+--------------------------------------------+

####### C. Attributes of the Data

+--------------------------+-------------------------------------------+
| 1\. Is the use of the    | Yes. The individual traveler's profile    |
| data both relevant and   | data is needed to accurately reserve and  |
| necessary to the purpose | ticket travel, and to have expenses       |
| for which the system is  | charged to the proper travel charge card  |
| being designed?          | account. The reservation data are needed  |
|                          | to accomplish the required travel, and to |
|                          | estimate trip costs for authorization     |
|                          | purposes. The TAVS data are required to   |
|                          | properly record the obligation of funds,  |
|                          | to accurately calculate and accomplish    |
|                          | reimbursement of the traveler and/or      |
|                          | payment to the travel card vendor, and to |
|                          | liquidate the obligation when payment is  |
|                          | made.                                     |
+--------------------------+-------------------------------------------+
| 2.a. Will the system     | No                                        |
| derive new data or       |                                           |
| create previously        |                                           |
| unavailable data about   |                                           |
| an individual through    |                                           |
| aggregation from the     |                                           |
| information collected?   |                                           |
+--------------------------+-------------------------------------------+
| 2.b. Will the new data   | Not Applicable                            |
| be placed in the         |                                           |
| individual\'s record     |                                           |
| (client or employee)?    |                                           |
+--------------------------+-------------------------------------------+
| 2.c. Can the system make | Not Applicable. This type of analysis is  |
| determinations about     | not done within the system.               |
| individuals that would   |                                           |
| not be possible without  |                                           |
| the new data?            |                                           |
+--------------------------+-------------------------------------------+
| 2.d. How will the new    | Not Applicable                            |
| data be verified for     |                                           |
| relevance and accuracy?  |                                           |
+--------------------------+-------------------------------------------+
| 3.a. If the data is      | Some consolidation may be done. Data may  |
| being consolidated, what | be consolidated if there are multiple     |
| controls are in place to | travel programs existing within an agency |
| protect the data and     | before its migration to eTS. Reports      |
| prevent unauthorized     | generated of aggregate activity may be    |
| access? Explain.         | accessed only by agency management and    |
|                          | System Administrators. Such reports do    |
|                          | not contain information on or impact      |
|                          | individual authorization or payment       |
|                          | records, profiles, or reservations in the |
|                          | system. As the system interfaces with     |
|                          | agency financial systems, information     |
|                          | regarding invoices and reimbursement will |
|                          | be fed to the appropriate systems. They   |
|                          | act as feeder systems and no direct user  |
|                          | interface is applicable. Data may be      |
|                          | consolidated by a Federal Agency          |
|                          | post-migration for reporting purposes     |
|                          | either internally to the agency or to GSA |
|                          | and/or OMB.                               |
+--------------------------+-------------------------------------------+
| 3.b. If processes are    | Consolidation of the authorization,       |
| being consolidated, are  | reservation, and payment processes in the |
| the proper controls      | system does not negate any of the access  |
| remaining in place to    | controls. Total system access has the     |
| protect the data and     | same limited access and security          |
| prevent unauthorized     | protections of each of its components.    |
| access? Explain.         |                                           |
+--------------------------+-------------------------------------------+
| 4\. How will the data be | Travel data will be retrieved by personal |
| retrieved? Can it be     | identifier. The approver will retrieve    |
| retrieved by personal    | data based on traveler name. Reports may  |
| identifier? If yes,      | be run based on Personally Identifiable   |
| explain.                 | Information as well.                      |
|                          |                                           |
|                          | The various data elements can be          |
|                          | retrieved in the same manner in which     |
|                          | they are input, i.e., via secure Internet |
|                          | connection, system login, and password,   |
|                          | with retrieval limited to the individuals |
|                          | who may input the data elements, except   |
|                          | that agency travel managers and the       |
|                          | System Administrator may also access data |
|                          | in the system.                            |
+--------------------------+-------------------------------------------+
| 5\. What are the         | The potential effects on the privacy      |
| potential effects on the | rights of employees include:              |
| privacy rights of        |                                           |
| individuals of:          | a.  Connectivity to agency back office    |
|                          |     systems (e.g. Human Resources and     |
| a\. Consolidation and    |     Financial).                           |
| linkage of files and     |                                           |
| systems;                 | b.  There is no derivation of data.       |
|                          |                                           |
| b\. Derivation of data;  | c.  There is decision making based the    |
|                          |     Federal Travel Regulations and agency |
| c\. Accelerated          |     business rules.                       |
| information processing   |                                           |
| and decision making; and | d.  The eTS will facilitate and expedite  |
|                          |     the authorization, arranging, and     |
| d\. Use of new           |     payment of travel within a secure     |
| technologies.            |     electronic environment. Personal      |
|                          |     information may be revealed due to    |
| How are the effects to   |     this new technology (e.g. faxing of   |
| be mitigated?            |     receipts).                            |
|                          |                                           |
|                          | Travelers who cannot make on-line         |
|                          | reservations may continue to call the TMC |
|                          | for reservations. Separate authorization  |
|                          | and payment processes may be required in  |
|                          | such cases. Some privacy information,     |
|                          | such as the social security number is     |
|                          | masked so that the entire number is not   |
|                          | displayed. Other information is likewise  |
|                          | masked or not displayed if the user does  |
|                          | not have the appropriate access controls. |
+--------------------------+-------------------------------------------+

####### D. Maintenance of Administrative Controls

+---------------------------+------------------------------------------+
| 1.a. Explain how the      | The eTS provides an electronic means for |
| system and its use will   | Federal travelers to accomplish their    |
| ensure equitable          | travel needs. All agency restrictions    |
| treatment of individuals. | and controls apply to every user of the  |
|                           | system.                                  |
+---------------------------+------------------------------------------+
| 1.b. If the system is     | This is a web-based system. The system   |
| operated in more than one | is operated in only one site. Users will |
| site, how will consistent | be geographically separated, accessing   |
| use of the system be      | the system via a web browser over the    |
| maintained at all sites?  | "Internet."                              |
+---------------------------+------------------------------------------+
| 1.c. Explain any          | Travelers who do not have access to the  |
| possibility of disparate  | Internet, or cannot be authenticated to  |
| treatment of individuals  | eTS, must call the TMC for reservations, |
| or groups.                | and may be required to use a different   |
|                           | authorization and vouchering process.    |
+---------------------------+------------------------------------------+
| 2.a. What are the         | The TAVS data are maintained in          |
| retention periods of data | accordance with the General Records      |
| in this system?           | Retention Schedules issued by the        |
|                           | National Archives and Records            |
|                           | Administration. Data will be stored for  |
|                           | six years three months; this is          |
|                           | specified in the vendor contracts. The   |
|                           | contract stipulates: "The eTS should     |
|                           | provide online access to detailed        |
|                           | transaction information for a minimum    |
|                           | period of 36 months, and permit access   |
|                           | to archived detailed transaction         |
|                           | information for a period of 6 years and  |
|                           | 3 months."                               |
|                           |                                          |
|                           | NARA guidelines regarding records        |
|                           | disposition are to be followed. As       |
|                           | specified in the contract "The eTS shall |
|                           | prevent the purging of historical        |
|                           | records prior to the proper retention    |
|                           | period, and permit purging only of those |
|                           | records authorized for disposal by the   |
|                           | National Archives and Records            |
|                           | Administration (NARA) per 36 CFR 1228    |
|                           | and 1234. NARA General Records Schedule  |
|                           | 9 for Travel and Transportation Records  |
|                           | and General Records Schedule 20 for      |
|                           | Electronic Records shall apply."         |
|                           |                                          |
|                           | Traveler profile data may be updated by  |
|                           | the traveler, the TMC, or the System     |
|                           | Administrator as needed. The profile is  |
|                           | maintained as long as the individual     |
|                           | travels, or may travel, at Government    |
|                           | expense.                                 |
|                           |                                          |
|                           | The on-line booking engine database      |
|                           | holds post-travel data for reporting     |
|                           | purposes for 90 days.                    |
+---------------------------+------------------------------------------+
| 2.b. What are the         | TAVS data that exist only in electronic  |
| procedures for            | form are to be permanently deleted at    |
| eliminating the data at   | the end of the prescribed records        |
| the end of the retention  | retention period. Hard copy data are to  |
| period? Where are the     | be destroyed at that time.               |
| procedures documented?    |                                          |
|                           | NARA guidelines regarding records        |
|                           | disposition are to be followed. As       |
|                           | specified in the contract "The eTS shall |
|                           | prevent the purging of historical        |
|                           | records prior to the proper retention    |
|                           | period, and permit purging only of those |
|                           | records authorized for disposal by the   |
|                           | National Archives and Records            |
|                           | Administration (NARA) per 36 CFR 1228    |
|                           | and 1234. NARA General Records Schedule  |
|                           | 9 for Travel and Transportation Records  |
|                           | and General Records Schedule 20 for      |
|                           | Electronic Records shall apply."         |
|                           |                                          |
|                           | E2 Solutions data will be properly       |
|                           | disposed of when no longer needed. Hard  |
|                           | copy materials will be shredded;         |
|                           | electronic data will be degaussed when   |
|                           | applicable.                              |
|                           |                                          |
|                           | There are three situations in which      |
|                           | trips/data are deleted from the          |
|                           | database, however, it will be retained   |
|                           | in the archival files:                   |
|                           |                                          |
|                           | 1.  Trips that were created over 365     |
|                           |     days ago.                            |
|                           |                                          |
|                           | 2.  Trips that were taken over 100 days  |
|                           |     ago.                                 |
|                           |                                          |
|                           | 3.  Users that have not logged in for    |
|                           |     100 days and have been marked for    |
|                           |     deletion. All data associated with   |
|                           |     the user is deleted, including       |
|                           |     trips.                               |
+---------------------------+------------------------------------------+
| 2.c. While the data is    | TAVS data rarely changes. Traveler       |
| retained in the system,   | initiated changes may occur, for         |
| what are the requirements | example, because a different bank        |
| for determining if the    | account is desired for EFT               |
| data is still             | reimbursement. Financial systems may     |
| sufficiently accurate,    | make updates to all travelers' files     |
| relevant, timely, and     | periodically to assure timely and        |
| complete to ensure        | accurate payment.                        |
| fairness in making        |                                          |
| determinations?           | Profile data elements are as accurate as |
|                           | the traveler keeps them. Trip data is as |
|                           | accurate as the last "refreshed" version |
|                           | the on-line booking engine saw of the    |
|                           | Passenger Naming Record (PNR).           |
+---------------------------+------------------------------------------+
| 3.a. Is the system using  | No. The Internet access is similar to    |
| technologies in ways that | that already in use for Thrift Savings   |
| Federal agencies have not | Plan (TSP) and Employee Express.         |
| previously employed (e.g. |                                          |
| Caller-ID)?               | []{.mark}                                |
+---------------------------+------------------------------------------+
| []{.mark}                 | The eTS has no independent impact on     |
|                           | Federal traveler privacy. Some of the    |
| 3.b. How does the use of  | data entered into the system are already |
| this technology affect    | collected and maintained by travel       |
| individuals' privacy?     | agencies under contract to the           |
|                           | Government, and some are currently       |
|                           | maintained by authorization and voucher  |
|                           | payment systems of agencies.             |
+---------------------------+------------------------------------------+
| 4.a. Will this system     | Yes. Federal agency travel managers,     |
| provide the capability to | System Administrators, and the TMC may   |
| identify, locate, and     | view an individual's reservation before, |
| monitor individuals? If   | during, and after travel. However,       |
| yes, explain.             | deviations from reservations outside the |
|                           | eTS will not be known or detectable from |
|                           | the system. For example, if a traveler   |
|                           | changes flights at an airport counter,   |
|                           | the change will not be reflected in eTS. |
+---------------------------+------------------------------------------+
| []{.mark}                 | []{.mark}                                |
|                           |                                          |
| 4.b. Will this system     | Yes. Federal agency travel managers,     |
| provide the capability to | System Administrators, and the TMC may   |
| identify, locate, and     | view a group of individuals'             |
| monitor groups of people? | reservations before, during, and after   |
| If yes, explain.          | travel. However, deviations from         |
|                           | reservations outside the eTS will not be |
| []{.mark}                 | known or detectable from the system.     |
+---------------------------+------------------------------------------+
| 4.c. What controls will   | Individuals are given various levels of  |
| be used to prevent        | access to the system. Only agency travel |
| unauthorized monitoring?  | managers, the System Administrator, and  |
|                           | the TMC may access others' records in a  |
|                           | manner that constitutes monitoring. In   |
|                           | addition, there are policies in place    |
|                           | such as the Rules of Behavior, which     |
|                           | helps to prevent unauthorized            |
|                           | monitoring.                              |
|                           |                                          |
|                           | Access logs are also kept and analyzed   |
|                           | for unauthorized access. The E2 System   |
|                           | provides a robust set of audit           |
|                           | capabilities, which can be tailored to   |
|                           | the policies and needs of each           |
|                           | individual customer agency. As a result, |
|                           | the E2 System provides the ability to    |
|                           | trace activities of any single           |
|                           | individual, to include systems           |
|                           | administrators, back to a single         |
|                           | individual through their account         |
|                           | identity. Procedures exist to report any |
|                           | violations of appropriate use to the     |
|                           | appropriate Government agency or         |
|                           | internal corporate authorities (assuming |
|                           | the individual is an employee of one of  |
|                           | the contract agencies supplying the E2   |
|                           | System services).                        |
+---------------------------+------------------------------------------+
| []{.mark}                 | []{.mark}                                |
|                           |                                          |
| 5.a. Under which Privacy  | General Services Administration, System  |
| Act System of Records     | of Records under the Privacy Act of      |
| notice (SOR) does the     | 1974, Contracted Travel Services         |
| system operate? Provide   | Program: GSA/GOVT-4.                     |
| number and name.          |                                          |
|                           | []{.mark}                                |
+---------------------------+------------------------------------------+
| []{.mark}                 | The subject SOR (GSA/GOVT-4) will be     |
|                           | modified to include provision of data to |
| 5.b. If the system is     | the eTS as another routine use of        |
| being modified, will the  | traveler data. The SOR may also need to  |
| SOR require amendment or  | be modified if agencies determine that   |
| revision? Explain.        | the eTravel SOR does not cover specifics |
|                           | covered under their travel SOR. The SOR  |
|                           | already identifies much of the data and  |
|                           | uses that the eTS holds. The eTS is      |
|                           | another medium for accessing the data.   |
+---------------------------+------------------------------------------+

######## 

######