**United States Department of Justice**

Antitrust Division

General Purpose Support System (GPSS)

Privacy Impact Assessment

Prepared By

United States Department of Justice

Antitrust Division

29-SEPTEMBER-2006

**Approval Signature Page**

I recommend approval of the Antitrust Division Information Systems
Support Group Management Information Systems Privacy Impact Assessment

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Cheryl Porpora Date\
System Owner, General Purpose Support System\
Chief, Office Automation Staff

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Carl Anderson Date

Chief, Information Systems Support Group

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Thomas King Date

Executive Officer, Antitrust Division

I approve the Antitrust Division Information Systems Support Group
General Purpose Support Systems Privacy Impact Assessment

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Jane Horvath Date

Chief Privacy and Civil Liberties Officer

**Table of Contents**

[Introduction 1](#introduction)

[GPSS PIA Framework 1](#gpss-pia-framework)

[Section 1.0 The System and the Information Collected and Stored within
the System.
2](#section-1.0-the-system-and-the-information-collected-and-stored-within-the-system)

[Section 2.0 The Purpose of the System and the Information Collected and
Stored within the System.
3](#section-2.0----the-purpose-of-the-system-and-the-information-collected-and-stored-within-the-system)

[Section 3.0 Uses of the System and the Information.
4](#section-3.0----uses-of-the-system-and-the-information)

[Section 4.0 Internal Sharing and Disclosure of Information within the
System.
6](#section-4.0----internal-sharing-and-disclosure-of-information-within-the-system)

[Section 5.0 External Sharing and Disclosure
7](#section-5.0----external-sharing-and-disclosure)

[Section 6.0 Notice 8](#section-6.0----notice)

[Section 7.0 Individual Access and Redress
9](#section-7.0----individual-access-and-redress)

[Section 8.0 Technical Access and Security
9](#section-8.0----technical-access-and-security)

[Section 9.0 Technology 12](#section-9.0----technology)

[Conclusion 13](#conclusion)

[Appendix A: ATR SORN 14](#appendix-a-atr-sorn)

[Appendix B: References 15](#appendix-b-references)

[Appendix C: Abbreviations and Acronyms
17](#appendix-c-abbreviations-and-acronyms)

# Introduction

The Department of Justice (DOJ) Antitrust Division (ATR) Information
Systems Support Group (ISSG) Office Automation Staff (OAS) owns the ATR
General Support System (GPSS) that is used to process, store and
transmit information. The ATR GPSS is a Sensitive But Unclassified (SBU)
system that is governed by the provisions of the Federal Information
Security Management Act (FISMA, Public Law 107-347) and DOJ Order
2640.2E Information Technology Security.

The mission of the Antitrust Division is to promote and protect the
competitive process and the American economy through enforcement of the
antitrust laws. The antitrust laws apply to virtually all industries and
to every level of business, including manufacturing, transportation,
distribution, and marketing. They prohibit a variety of practices that
restrain trade, such as price-fixing conspiracies, corporate mergers
likely to reduce the competitive vigor of particular markets, and
predatory acts designed to achieve or maintain monopoly power.

The ATR-GPSS is the Division's network infrastructure that supports the
mission through the establishment, maintenance and delivery of office
automation applications to all the Division's users. It hosts Litigation
Support Services (LSS) and Management Information Systems (MIS)
applications. The LSS applications handle ongoing investigations and
cases and are directly hosted on GPSS.

The Antitrust Division makes broad use of National, Government and
Department standards in assuring the protection of Privacy Act systems
under its control. A key part of the standards usage focuses on the
FISMA-mandated (FISMA Sec. 303 (b)(1)(A)) Federal Information Processing
Standards (FIPS) and associated National Institute of Standards and
Technology (NIST) Special Publications (SPs). The Antitrust Division has
developed a managed process to ensure that its security program is
current with all applicable revisions and releases of FIPS, NIST SPs,
and OMB Memoranda in order to protect its assets. This programmatic
effort is complimented by scanning activities to ensure that the
system's patches and fixes are fully current, and that its security
configuration polices are not compromised.

ATR regards the protection of information security, as defined in 44
U.S.C. Section 3542, as a critical factor in the enforcement of
antitrust law in both criminal and civil enforcement actions. The GPSS
implementation and continuing enhancement of security safeguards is
aligned with fulfilling ATR's security mandate for a hardened
infrastructure and secure office automation services.

# GPSS PIA Framework

The GPSS PIA Framework provides programmatic information associated with
the development and management of the GPSS PIA.

## Document Compliance

This GPSS PIA complies with the Privacy Impact Assessment Official
Guidance issued by the DOJ Privacy and Civil Liberties Office, effective
August 7, 2006.

## Document Organization

This GPSS PIA applies the DOJ Privacy Impact Assessment Template (v3) as
follows:

-   Introduction;

-   Responses to questions, and summaries requested in Sections 1
    through 9 of the afore-referenced template;

-   Conclusion.

The following appendices are included:

-   Appendix A: ATR SOR

-   Appendix B: References

-   Appendix C: Abbreviations and Acronyms

## Document Audience

This document is intended for public access in accordance with OMB
M-03-22 Guidance for Implementing the Privacy Provisions of the
E-Government Act of 2002, Attachment A/I.A.1.

## 

## Document Change Control

Once baselined, the work-in-progress GPSS PIA will be subject to formal
ISSG change control.

## GPSS PIA Point of Contact

Mr. Thomas King

ATR Executive Officer

Patrick Henry Building\
601 D Street NW, Washington, DC 20530

Telephone: 202-514-4005

E-mail: THOMAS.KING@USDOJ.GOV

# Section 1.0 -- The System and the Information Collected and Stored within the System

## What information is to be collected?

-   ATR document requests for handling civil and criminal investigations
    e.g., subpoenas, Civil Investigative Demands, identify information
    that has to be collected. This information is used in the Division's
    ongoing investigations and cases.

-   Contract proposals, which contain contractor resumes

-   Contact lists, which contains contractor names and telephone
    numbers.

-   GPSS currently includes the following Information in Identifiable
    Form (IIF) from many companies and individuals that are party to
    antitrust enforcement activities, and from ATR staff.

```{=html}
<!-- -->
```
-   Name: Company; Individual; ATR staff

-   Social Security Number: ATR staff (specifically: Performance
    Evaluation; Work Plans, Performance Execution documentation)

-   Address: Company; Individual; ATR staff

-   Telephone Number: Company; Individual; ATR staff

-   E-mail: Company; Individual; ATR staff

-   Date of Birth: Individual

-   Travel Records: Company, Individual

-   Credit Card details: Company, Individual

-   Criminal History: Company, Individual

-   Business Classification: Company

## 1.2 From whom is the information collected?

Information is collected from any party to, or target of, ongoing
criminal or civil antitrust investigations. Information is also
collected via internet searches for publicly available information such
as company name, company address company phone number and email, used in
confirming information previously provided by companies and individuals
in response to law enforcement requests. Information also is provided by
ATR government and contractor personnel who support the Division's
mission.

# Section 2.0 \-- The Purpose of the System and the Information Collected and Stored within the System

## Why is the information being collected?

The information is collected to support ATR's charter; specifically
promotion and protection of the competitive process and the United
States economy via the enforcement of antitrust laws. Although OAS
implements all required safeguards for IIF, this information is
secondary to the primary information requirements, which focus on
economic and market data. For example, the Division may send subpoena to
Company A, asking for its records of soda sales from 2004-2005. The
company may respond with invoices that potentially could include a
customer's IIF.

## 2.2 What specific legal authorities, arrangements, and/or agreements authorize the collection of information?

ATR is authorized to collect information under the provisions of the
Sherman Antitrust Act, the Clayton Antitrust Act, and the
Hart-Scott-Rodino Act.

## 2.3 [Privacy Impact Analysis]{.underline}: Given the amount and type of information collected, as well as the purpose, discuss what privacy risks were identified and how they were mitigated. 

The predominant concern is a breach to the Confidentiality security
objective. From a GPSS perspective, this breach would occur, primarily,
via unauthorized access that would enable an adversary to disclose,
damage the integrity of, or prevent the availability of information used
to support the enforcement of Antitrust laws.

To mitigate known risks, the following measures are in place:

-   Division staff generally will ask that parties NOT provide
    information such as Social Security numbers. Also, any information
    received is treated confidentially and only revealed to those who
    have a need-to-know.

-   Various statutes provide criminal penalties to those who mis-handle
    the information, and staff is informed of that consequence.

-   Contract staff sign confidentiality forms,

-   Data is kept in cipher-locked rooms in the case of grand jury data
    and in secure areas for civil matters. Further, these rooms are
    located in secure, guarded and/or alarmed office space.

ATR OAS is currently addressing the implementation of the FISMA security
controls commensurate with its Security Category as mandated via FIPS
200 Minimum Security Requirements for Federal Information and
Information Systems and amplified in NIST SP 800-53 Recommended Security
Controls for Federal Information Systems. The GPSS implementation of
these controls is reflected in FISMA and JMD-mandated security
documentation.

# Section 3.0 \-- Uses of the System and the Information

## 3.1 Describe all uses of the information.

The information that GPSS processes, stores and transmits to support the
ATR Mission maps to the following NIST SP 800-60 information categories:

-   Administrative Management

-   Financial Management

-   General Government

-   Human Resources

-   Information and Technology Management

-   Internal Risk Management and Mitigation

-   Knowledge Creation and Management

-   Legislative Relations

-   Litigation and Judicial Activities

-   Planning and Resource Allocation

-   Public Affairs

-   Regulatory Development

-   Revenue Collection

-   Supply Chain Management

## 3.2 Does the system analyze data to assist users in identifying previously unknown areas of note, concern, or pattern? (Sometimes referred to as data mining.) 

Data mining, including pattern-based querying, is employed in the course
of investigations using the tools of litigation support and economic
analysis. It is necessary to emphasize that the scope of data mining is
limited to DOJ Order 2640.2E requirements for Least Privilege (NIST SP
800-53/AC-6) and Need-to Know (addressed via NIST SP 800-53/AC-2).
Nonetheless, many of the GPSS-hosted applications, such as Summation,
CaseMap, Legal Access Ware, and iManage do provide the capability to
construct queries and reports designed to illuminate patterns of
conduct, purchasing patterns, as well as geographic or product market
patterns in the course of the investigations of possible antitrust
violations.

## 3.3 How will the information collected from individuals or derived from the system, including the system itself be checked for accuracy? 

Information collected initially from subjects of the investigation or
witnesses is subjective and requires subsequent validation by
investigators to verify its accuracy. Validation is performed through
subsequent interviews, searches of other databases, and other law
enforcement methods. The Division may demand that parties verify that
submissions represent accurate copies of their records. Comparisons will
be made among industry respondents to provide a limited verification of
the data. Employee information is verified through agency personnel
channels.

## 3.4 What is the retention period for the data in the system? Has the applicable retention schedule been approved by the National Archives and Records Administration (NARA)? 

-   There is no specific retention period for electronic data; however,
    there is a 3-month backup retention schedule for disaster recovery
    purposes.

-   Any data received from outside sources in paper form are returned to
    the parties upon matter closure and all paper copies are destroyed.

-   In some instances, electronic data on magnetic disk may be retained
    for use in related investigations until all related investigations
    are complete.

## 3.5 [Privacy Impact Analysis]{.underline}: Describe any types of controls that may be in place to ensure that information is handled in accordance with the above-described uses. 

The key GPSS controls to assure that information is handled in
accordance with its prescribed use include:

-   Technical Class Controls

    -   Access Controls:

        -   Account Management (NIST SP 800-53/AC-2)

        -   Access Enforcement (NIST SP 800-53/AC-3)

        -   Separation of Duties (NIST SP 800-53/AC-5)

        -   Least Privilege (NIST SP 800-53/AC-6)

        -   Unsuccessful Login Attempts (NIST SP 800-53/AC-7)

        -   System Use Notification (NIST SP 800-53/AC-8)

        -   Session Lock (NIST SP 800-53/AC-11)

        -   Supervision and Review -Account Management (NIST SP
            800-53/AC-13)

```{=html}
<!-- -->
```
-   Audit Controls:

```{=html}
<!-- -->
```
-   Auditable Events (NIST SP 800-53/AU-2)

-   Audit Analysis, Monitoring, and Reporting (NIST SP 800-53/AU-6)

```{=html}
<!-- -->
```
-   Identification and Authentication:

```{=html}
<!-- -->
```
-   Authenticator Management (NIST SP 800-53/IA-5)

```{=html}
<!-- -->
```
-   Management Class Controls

```{=html}
<!-- -->
```
-   Security Planning, Policy, and Procedures

    -   Rules of Behavior (NIST SP 800-53/PL-4)

        -   Systems and Services Acquisition Policy and Procedures

            -   Software Usage Restrictions (NIST SP 800-53/SA-6)

            -   Security Engineering Principles (NIST SP 800-53/SA-8)

```{=html}
<!-- -->
```
-   Operational Class Controls

    -   Security Awareness and Training Policy and Procedures

        -   Security Awareness (NIST SP 800-53/AT-2)

        -   Security Training (NIST SP 800-53/AT-3)

ATR is required to address continual statutory and Department-level
requirements to substantiate that its handling of information is
compliant. For example, ATR was recently required to provide submissions
in support of DOJ Memorandum Privacy and Safeguarding of Personally
Identifiable Information dated 10-July-2006. Furthermore, ATR issued ATR
Directive 2710.4 Safeguarding Sensitive Information dated 11-July -2006
to assure Division compliance. From a technical perspective
FISMA-mandated Continuous Monitoring requirements (NIST SP 800-53/CA-7)
provide assurance that privacy-applicable controls are consistent with
the GPSS Certification and Accreditation status.

# Section 4.0 \-- Internal Sharing and Disclosure of Information within the System

## With which internal components of the Department is the information shared?

ATR shares data, as needed and appropriate, as part of the investigative
process. Data submitted in conjunction with criminal or civil
investigations is shared as follows

-   Criminal

Federal Bureau of Investigation,

United States Attorneys' Offices

Criminal Division

Office of the Inspector General

-   Civil:

United States Attorney's Offices

Office of the Inspector General

## 4.2 For each recipient component or office, what information is shared and for what purpose?

-   Specific information identified in Section 1.1 may be shared with
    internal DOJ components with a need to know. Information shared
    depends on the component's identified need and the nature of the
    investigation. Determinations of what information may be shared are
    made by the Division's legal staff, working in consultation with the
    requesting government organization.

-   In some cases, a DOJ component, such as the FBI, may work at an ATR
    site, specifically on ATR matters. In addition, Division staff will
    sometimes partner with a local USAO to work on a specific
    investigation where the USAO has specific industry expertise or
    knowledge of a particular geographic location in which the Division
    is conducting an investigation.

-   On rare occasions, data received in an ATR investigation may relate
    to an ongoing Criminal Division investigation and has been shared
    with that Division. Any data shared will be specific to a defined
    law enforcement related need to know.

## 4.3 How is the information transmitted or disclosed?

Information is

-   exchanged via internal e-mail subject to GPSS controls

-   exchanged via DOJ-approved courier delivery

-   hand-carried.

## 4.4 [Privacy Impact Analysis]{.underline}: Given the internal sharing, discuss what privacy risks were identified and how they were mitigated. 

The fundamental privacy risk lies in unauthorized disclosure based on
methods of sharing. The two methods and the mitigation of potential
risks are as follows:

-   Information delivered by courier or hand-carried is subject to media
    labeling controls in accordance with DOJ Order 2640.2E and NIST SP
    800-53/MP-3. Transport of this information is subject to DOJ
    controls for Media Transport and is compliant with NIST SP
    800-53/MP-5.

-   E-mail is subject to GPSS security controls, which are
    FISMA-compliant based on its current Certification and Accreditation
    status.

All DOJ components are subject to DOJ Order 2640.1 and DOJ Order 2640.2E
and the associated Information Technology Security Standards.

# Section 5.0 \-- External Sharing and Disclosure 

## 5.1 With which external (non-DOJ) recipient(s) is the information shared?

To support ongoing antitrust enforcement activities, information may
need to be shared with the following external entities:

Criminal

-   Investigative Agencies

    -   Defense Contract Investigatory Services

    -   Department of Transportation

-   State Attorneys Generals

-   Outside experts working under contract to ATR on specific matters.

Civil Investigation

-   Federal Trade Commission

-   State Attorneys Generals

-   Industry experts working under contract to ATR on specific matters.

## What information is shared and for what purpose?

The non-DOJ recipients serve as contract experts in their noted areas
and assist in the analysis of the data. State Attorneys General staff
may assist with joint investigations and other filings. Evidentiary
information such as exhibits, affidavits, etc., which may be based on
information produced during discovery may also be shared by Court Order
and/or local rules of evidence.

## 5.3 How is the information transmitted or disclosed?

Information is hand-delivered to any outside parties.

## 5.4 Are there any agreements concerning the security and privacy of the data once it is shared? 

Data may be shared under Court order. Outside experts and others,
including individuals at other Government agencies must either sign
confidentiality agreements before receiving such data or be allowed such
access as part of a legitimate law enforcement activity.

## 5.5 What type of training is required for users from agencies outside DOJ prior to receiving access to the information?

All Government Agencies implement Standards of Ethical Conduct for
Employees of the Executive Branch (5 CFR 2635) via Rules of Behavior per
OMB Circular A-130, Appendix III.

## 5.6 Are there any provisions in place for auditing the recipients' use of the information?

There are no provisions in place at this time for auditing the
recipients' use of information. However, if ATR suspected or became
aware of misuse, it would use its full authority promptly to resolve the
issue.

## 5.7 [Privacy Impact Analysis]{.underline}: Given the external sharing, what privacy risks were identified and describe how they were mitigated.

Privacy risks in the form of disclosure and modification are mitigated
through procedural means such as the use of confidentiality agreements
with contract consultants and other outside parties. Some information is
subject to Protective Orders that limit disclosure of information. These
Orders are case-specific, and can vary based on the parties that are
involved. Some information is subject to Federal Rule of Criminal
Procedure 6(e), which addresses the issue of secrecy in grand jury
proceedings.

# Section 6.0 \-- Notice 

## 6.1 Was any form of notice provided to the individual prior to collection of information? If yes, please provide a copy of the notice as an appendix. (A notice may include a posted privacy policy, a Privacy Act notice on forms, or a system of records notice published in the Federal Register Notice.) If notice was not provided, why not?

The ATR System of Records Notices (SORN) listing is provided at Appendix
A, ATR SOR, of this PIA.

Any Privacy Act information that may be collected is related to Division
law enforcement purposes.

## 6.2 Do individuals have an opportunity and/or right to decline to provide information?

No. Any Privacy Act information that may be collected is related to
Division law enforcement purposes.

## 6.3 Do individuals have an opportunity to consent to particular uses of the information, and if so, what is the procedure by which an individual would provide such consent? 

No. Any Privacy Act information that may be collected is related to
Division law enforcement purposes.

## 6.4 [Privacy Impact Analysis]{.underline}: Given the notice provided to individuals above, describe what privacy risks were identified and how you mitigated them.

The predominant privacy risk lies in improper disclosure. All DOJ
government and contractor staff are aware of penalties regarding
improper use of information per Entry On Duty training materials and
Rules of Behavior.

# Section 7.0 \-- Individual Access and Redress 

## 7.1 What are the procedures which allow individuals the opportunity to seek access to or redress of their own information?

Individuals may make a request for access to or amendment of their
records under the Privacy Act unless the particular System of Records is
exempted from the access and amendment provisions.

## 7.2 How are individuals notified of the procedures for seeking access to or amendment of their information? 

Notice of individual's rights under the Privacy Act is provided through
publication in the Federal Register of a System of Records Notice and in
Departmental regulations describing the procedures for making
access/amendment requests.

## 7.3 If no opportunity to seek amendment is provided, are any other redress alternatives available to the individual? 

No.

## 7.4 [Privacy Impact Analysis]{.underline}: Discuss any opportunities or procedures by which an individual can contest information contained in this system or actions taken as a result of agency reliance on information in the system.

Information on Government employees or contractors may be addressed
through a written request for correction if necessary. This process also
applies to business or private individuals who may request a correction
to publicly available information. An individual may file a lawsuit
under the Privacy Act after following appropriate administrative
processes.

# Section 8.0 \-- Technical Access and Security 

## 8.1 Which user group(s) will have access to the system?

The following groups have access to the ATR GPSS. Each member of a group
has read-write permissions for files within the group. The permissions
are implemented technically through Windows Directory Services which is
COTS software that enables a shared information infrastructure for
locating, managing, administrating, and organizing common items and
network resources.

-   Users: The user group has rights to shared data on the ATR GPSS.
    This group also has access to specific files within each user's
    section.

-   ATR Personnel Staff: The personnel group has access to ATR personnel
    data on the ATR GPSS.

-   Domain Administrator: Administrators have full rights to the ATR
    GPSS.

-   Local Administrators: Local administrators have full rights within
    their local group, e.g., ATR Philadelphia.

-   ATR Field Office Personnel Staff: Local personnel users have access
    to local personnel data within their local group.

## 8.2 Will contractors to the Department have access to the system? If so, please submit a copy of the contract describing their role with this PIA. 

Contractors have access to the system in the capacities referenced in
Section 8.1. Contract documents are available but not attached and may
be provided by the ATR point of contact.

## 8.3 Does the system use "roles" to assign privileges to users of the system?

GPSS users are assigned to group policies based on their job function.

## 8.4 What procedures are in place to determine which users may access the system and are they documented?

All Antitrust Division users must have access to the GPSS. The level of
access is determined by each user\'s job function (attorney, paralegal,
HR Specialist, IT Specialist, etc.) Documented Entry On Duty/Exit
Standard Operating Procedures are followed to ensure that each user has
only the access necessary to perform his/her job.

## How are the actual assignments of roles and rules verified according to established security and auditing procedures?

-   GPSS manages information system accounts in accordance with
    applicable DOJ account management policies and procedures. Each user
    account is specific to a particular user.

-   ATR assigns responsibilities to specific parties and specific
    actions are defined to ensure that information system accounts are
    managed correctly.

-   Information system accounts are managed consistently across the
    organization.

-   GPSS has established procedures for establishing, activating,
    modifying, disabling, and removing user accounts.

-   Procedures are followed per the System Operating Plan and Windows
    Directory Services.

-   Use of information system access controls is reviewed and supervised
    by the Operations Manager. Inappropriate access is investigated and
    documented and reported to the GPSS Information Systems Security
    Officer.

## What auditing measures and technical safeguards are in place to prevent misuse of data?

The primary auditing measures and technical safeguards that are in place
to prevent misuse of data are associated with access and authentication
controls to prevent unauthorized disclosure and subsequent potential
misuse of data. These controls include:

-   Authenticator/Password management, i.e., application and monitoring
    of initial distribution, composition, history, compromise, and
    change of default authenticators (NIST SP 800-53/IA-5)

-   Account Management, i.e., application and monitoring of account
    establishment, activation, modification, disabling, removal
    (including unnecessary/defunct accounts) and review, all of which
    support implementation of "need-to-know" (NIST SP 800-53/AC-2)

-   Access Enforcement, i.e., application and monitoring of access
    privileges (NIST SP 800-53/AC-3)

-   Least Privilege; i.e., provision of the minimum tools required for a
    user to perform his/her function (NIST SP 800-53/AC-6)

-   Unsuccessful Login Attempts: i.e., GPSS automatically locks the
    account until released by a System Administrator when the maximum
    number of unsuccessful attempt is exceeded. (NIST SP 800-53/AC-7)

-   System Use Notification, i.e., a user has to acknowledge Department
    \*policies regarding use before access is granted (NIST SP
    800-53/AC-8)

-   Session Lock, i.e., a user has to re-authenticate after a specified
    period of inactivity (NIST SP 800-53/AC-11)

-   Remote access is controlled and monitored. Encryption is used to
    protect the confidentiality of remote access sessions through the
    use of secure remote access tokens (NIST SP 800-53/AC-11)

-   Audit trails are generated by the GPSS. The audit trails facilitate
    intrusion detection and are a detective control for identifying data
    misuse. The GPSS also is configured to protect audit information and
    tools from unauthorized access, modification and deletion (NIST SP
    800-53/AU Family).

The referenced controls are FISMA requirements and are configured in
compliance with DOJ Order 2640.2E provisions.

## 8.7 Describe what privacy training is provided to users either generally or specifically relevant to the functionality of the program or system? 

All employees are required to complete online information systems
security training as part of annual training for DOJ employees. A
certificate of completion is logged for employees after successful
completion of the training. Also, new employees receive training on the
use of the system before they are granted access to the system. Users
are reminded periodically about Division policies in these areas and
their requirements to comply with these policies.

## 8.8 Is the data secured in accordance with FISMA requirements? If yes, when was Certification & Accreditation last completed?

The data are secured in accordance with the DOJ schedule-driven
implementation of FISMA requirements as recorded in the JMD Trusted
Agent application. The last Certification & Accreditation (C&A) was
completed in July, 2005.

## 8.9 [Privacy Impact Analysis]{.underline}: Given access and security controls, what privacy risks were identified and describe how they were mitigated.

Privacy risks associated with unauthorized disclosure of information are
mitigated through implementation of technical controls associated with
"need-to-know" and "least privilege," ensuring that users have no more
privileges to data than required to effect their official duties. In
addition, deterrent controls in the form of Warning Banners, Privileged
Rules of Behavior, Confidentiality Agreements and auditing are in place.
Finally, exit procedures for departing employees and contractors include
the prompt disabling of accounts and access rights to all data.

# Section 9.0 \-- Technology

## Were competing technologies evaluated to assess and compare their ability to effectively achieve system goals?

Yes. As the ATR General Purpose Support System was initially developed
many years ago, software tools were competitively identified to ensure
the best and most cost effective products were chosen. In subsequent
years, as ATR has upgraded and improved its GPSS, enhancements have been
developed and deployed by ATR staff. With all acquisitions of new or
upgraded hardware, software or other products, a cost-benefit analysis
has been performed in accordance with DOJ requirements. GPSS investments
are pursued in accordance with the relevant provisions of the Department
of Justice Systems Development Life Cycle Guidance and Federal
Acquisition regulations. []{.mark}

## 9.2 Describe how data integrity, privacy, and security were analyzed as part of the decisions made for your system.

In conformance with DOJ ITSS Standard 2.6, ATR implements data integrity
controls to protect data from accidental or malicious alteration or
destruction and to ensure that the information is accurate and has not
been altered. ATR employs an intrusion detection system to detect
vulnerabilities, changes to the network and traffic anomalies. ATR backs
up data regularly and controls access to data stored on the GPSS. As
part of ATR's decision-making process regarding security, ATR performed
a requirements analysis December 7, 2001, under the direction of the DOJ
Program Management Office (PMO). This document outlined the business,
functional and technical requirements for the ATR environment. To ensure
a secure environment, as well as to protect the integrity and
availability of data, the requirements analysis identified the
constraints and conditions adhered to during system deployment.

## 9.3 What design choices were made to enhance privacy? 

ATR's security strategy includes protecting ATR assets from outside
attackers as well as from internal security violations. To protect
personally identifiable and proprietary information, ATR implemented an
incident response plan and a GPSS computer security policy. ATR also
requires users to sign General User Rules of Behavior, which address
accountability by requiring ATR personnel to protect any and all
sensitive information stored or processed by ATR computer systems. ATR
also employs auditing controls, an intrusion detection system, secure
router configurations, inactivity logouts and firewalls. ATR installs
Pointsec security software on laptops to enhance the security of data.
Pointsec complies with Evaluation Assurance Level 4 in Common Criteria
quality certification (CC EAL4) and FIPS 140-1.

# Conclusion

GPSS is used to process, store, and transmit information that supports
Antitrust Division operations for management and support, and ongoing
mission-specific purposes. Securing this information and assuring its
proper use is critical to the success of these operations.

The GPSS solution is aligned with fulfilling ATR's security mandate for
a hardened infrastructure and secure office automation services.
Management review, continual enhancement, and FISMA-mandated continuous
monitoring of GPSS technical configuration and procedural controls are
of the utmost importance in maintaining network infrastructure security
and continuity of operations.

Access authorization, authentication rules, and audit controls have been
configured technically on the GPSS platform to implement and monitor
"need-to-know". These technical controls are supplemented by procedural
controls such as Rules of Behavior, Confidentiality Agreements, and
Security Awareness and Training to mitigate risks regarding unauthorized
access and subsequent potential privacy violations.

# Appendix A: ATR SORN

  -----------------------------------------------------------------------------
  **SYSTEM**   **TITLE**                        **DATE        **FEDERAL
                                                PUBLISHED**   REGISTER**
  ------------ -------------------------------- ------------- -----------------
  ATR-001      Antitrust Division Expert        10-13-89      54 FR 42061
               Witness File                                   

  ATR-003      Index of Defendants in Pending   10-10-95      60 FR 52690
               and Terminated Antitrust Cases                 

  ATR-004      Statements by Antitrust Division 10-10-95      60 FR 52691
               Officials (ATD Speech File)                    

  ATR-005      Antitrust Caseload Evaluation    10-17-88      53 FR 40502
               System (ACES) - Time Reporter                  

  ATR-006      Antitrust Caseload Evaluation    02-20-98\*\   63 FR 8659\*\
               System (ACES) - Monthly Report   03-29-01      66 FR 17200

  ATR-007      Antitrust Division Case Cards    10-10-95      60 FR 52692

  ATR-009      Public Complaints and Inquiries  11-17-80      45 FR 75902
               File                                           

  ATR-014      Civil Investigative Demand (CID) 10-10-95      60 FR 52694
               Tracking System                                
  -----------------------------------------------------------------------------

\*Last publication of complete notice

Source: http://jmdint01.atrnet.gov/jmd/privacy/#ATR on date of issuance
of this PIA.

# Appendix B: References

E-Government Act of 2002, Public Law 107-347, Section 208(b)

Freedom of Information Act (FOIA) (as amended), 5 U.S.C. 552

Privacy Act (PA) of 1974 (as amended), 5 U.S.C. 552a

Regulations Implementing The Privacy Act of 1974, 36 CFR §1202

Public Availability and Use of Federal Records, 36 CFR §1250

Information related to law enforcement investigations, 36 CFR
§1256.58(b)(4)

Standards of Ethical Conduct for Employees of the Executive Branch (5
CFR 2635)

OMB Circular A-ll, Preparation, Submission and Execution of the Budget

OMB Circular A-130, Management of Federal Information Resources,
Appendix III, Security of Federal Automated Information Resources

OMB Memorandum M-06-19 Reporting Incidents Involving Personally
Identifiable Information Incorporating the Cost for Security in Agency
Information Technology Investments (12-July-2006)

OMB Memorandum M-06-16 Protection of Sensitive Agency Information (23
June 2006)

OMB Memorandum M-06-15 Safeguarding Personally Identifiable Information
(22 May 2006)

OMB Memorandum M-06-02 Improving Public Access to and Dissemination of
Government Information and Using the Federal Enterprise Architecture
Data Reference Model

OMB Memorandum M-05-15 FY 2005 Reporting Instructions for the Federal
Information Security Management Act and Agency Privacy Management (13
Jun 2005)

OMB Memorandum M-05-08 Designation of Senior Agency Officials for
Privacy (11 Feb 2005)

OMB Memorandum M-05-04 Policies for Federal Agency Public Websites (17
Dec 2004)

OMB Memorandum M-04-04 E-Authentication Guidance (16 Dec 2003)

OMB Memorandum M-03-22 Guidance for Implementing the Privacy Provisions
of the E-Government Act of 2002 (26 Sep 2003)

OMB Memorandum M-00-13 Privacy Policies and Data Collection on Federal
Web Sites (22 June 2000)

OMB Memorandum M-01-05 Guidance on Inter-Agency Sharing of Personal Data
--Protecting Personal Privacy (20 Dec 2000)

OMB Memorandum M-99-18 Privacy Policies on Federal Web Sites (2 June
1999)

OMB Memorandum M-99-05 Instructions on Complying with President\'s
Memorandum of 14 May 1998, "Privacy and Personal Information in Federal
Records" (7 Jan 1999)

Federal Enterprise Architecture Security and Privacy Profile Phase 1
Final

Standards of Ethical Conduct for Employees of the Executive Branch (5
CFR 2635)

Letter from John Spotila (Chair, CIO Council Office of Information and
Regulatory Affairs) to Roger Baker (CIO, Department of Commerce Co-Chair
Security, Privacy, and Critical Infrastructure Committee), on
clarification of OMB Cookies Policy (5 Sep 2000)

Letter from Roger Baker (CIO, Department of Commerce Co-Chair Security,
Privacy, and Critical Infrastructure Committee) to John Spotila (Chair,
CIO Council Office of Information and Regulatory Affairs) on Federal
agency use of Web cookies (28 July 2000)

FIPS 200 Minimum Security Requirements for Federal Information and
Information Systems

FIPS 199 Standards for Security Categorization of Federal Information
and Information Systems

NIST SP 800-92 Guide to Computer Security Log Management (DRAFT)

NIST SP 800-80 Guide for Developing Performance Metrics for Information
Security (DRAFT)

NIST SP 800-65 Integrating Security into the Capital Planning and
Investment Control Process

NIST SP 800-60, Guide for Mapping Types of Information and Information
Systems to Security Categories

NIST SP 800-55 Security Metrics Guide for Information Technology Systems

NIST SP 800-53 Recommended Security Controls for Federal Information
Systems

NIST SP 800-44 Guidelines on Securing Public Web Servers

NIST SP 800-37, Guide to the Security Certification and Accreditation of
Federal Information Systems

NIST SP 800-30 Risk Management Guide for Information Technology Systems

NIST SP 800-18 Rev 1 Guide to System Security Plans for Federal
Information Systems

DOJ Order 3011.1 Compliance with the Privacy Act

DOJ Order 2880.1B Information Resources Management Program

DOJ Order 2640.2E Information Technology Security

DOJ Order 2640.1 Privacy Act Security Regulations for Systems of
Records,

DOJ Privacy Impact Assessment Official Guidance Manual April 2006

DOJ Memorandum issued on 02-May-2006, Personal Information on DOJ
Websites

DOJ Memorandum issued on 10-July-2006, Privacy and Safeguarding of
Personally Identifiable Information

ATR Directive 2710.4 Safeguarding Sensitive Information 11-July -2006

# Appendix C: Abbreviations and Acronyms

  ---------- ------------------------------------------------------------
  ATR        Antitrust Division

  C&A        Certification & Accreditation

  COAR       Common Office Automation Resources

  DCIS       Defense Contract Investigatory Services

  DOJ        Department of Justice

  DOT        Department of Transportation

  FEA        Federal Enterprise Architecture

  FIPS       Federal Information Processing Standard

  FISMA      Federal Information Security Management Act

  FTC        Federal Trade Commission

  GPSS       General Purpose Support System

  GSS        General Support System

  ISSG       Information Systems Support Group

  JCON       Justice Consolidated Office Network

  JMD        Justice Management Division

  LSS        Litigation Support Services

  MIS        Management Information Systems

  MSS        Management Support Staff

  NIST       National Institute of Standards and Technology

  OAS        Office Automation Staff

  OMB        Office of Management and Budget

  PIA        Privacy Impact Assessment

  SBU        Sensitive But Unclassified

  SC         Security Category

  SORN       System of Records Notification

  SP         Special Publication

  SSP        System Security Plan

  UPI        Unique Project Identifier
  ---------- ------------------------------------------------------------