1 

Federal Trade Commission

Privacy Impact Assessment

FTC WiFi Networks

(WiFi)

Updated December 2018

Reviewed March 2022

Reviewed April 2021
2 

Table of Contents

1 System Overview .................................................................................................................... 1

2 Data Type, Sources, and Use .................................................................................................. 4

3 Data Access and Sharing ........................................................................................................ 7

4 Notice and Consent ................................................................................................................. 9

5 Data Accuracy and Security .................................................................................................. 10

6 Data Retention and Disposal ................................................................................................. 11

7 Website Privacy Evaluation .................................................................................................. 12

8 Privacy Risks and Evaluation ............................................................................................... 12
1 

1 System Overview

1.1 Describe the project/system and its purpose. 

The FTC’s Office of Chief Information Officer (OCIO) handles the Commission’s various 

information technology (IT) and infrastructure needs. As a component of its IT program, OCIO

operates WiFi1 Networks at all FTC locations to support Commission activities and to meet specific 

agency needs. The following components represent the FTC’s WiFi Networks:

WiFi Network Description

FTC WiFi The FTC WiFi network provides WiFi connectivity to the FTC 

internal network. Access is restricted to government-owned 

equipment. Information maintained by the FTC WiFi network 

includes the Service Set Identifier (SSID), which is more commonly 

known as the network name in a WiFi implementation.

Employee Personal 

WiFi

The Employee Personal WiFi network provides WiFi Internet 

connectivity to FTC staff members at FTC offices for personal WiFi

devices. Each employee is permitted to connect one personal device 

(i.e., personal smartphone, tablet, etc.) to the Employee Personal 

WiFi network. Access is restricted to approved users and 

equipment. The Employee Personal WiFi network maintains the 

SSID as well as the passphrase needed to connect to the WiFi 

network. 

To use the Employee Personal WiFi on an Android device, users 

must download the Aruba QuickConnect app. This app may request 

access to information on a user’s personal device. Any information 

gathered by the QuickConnect app is not shared with the FTC, and 

the QuickConnect vendor’s use of such information is beyond the 

scope of this PIA. For information on the QuickConnect app, see 

the Aruba Clearpass Quickconnect Data Sheet or information 

available on Google Play. 

Guest WiFi The Guest WiFi network provides WiFi Internet connectivity to 

scheduled visitors and consultants at FTC offices. Access is 

restricted to approved individuals and equipment. The Guest WiFi 

network maintains the SSID and passphrase needed to connect to the 

WiFi network. 

Conference WiFi The Conference WiFi network provides WiFi Internet connectivity 

to participants at FTC public events. Access is unrestricted, but is 

limited to the location and duration of the event. The Conference 

WiFi network maintains the SSID and passphrase issued by the 

FTC. 

 

1 WiFi (or Wi-Fi) is a technology that allows electronic devices to connect to the Internet or communicate with one 

another wirelessly within a particular area. This PIA discusses how the FTC collects and uses information affiliated 

with its WiFi networks: any collection or use of FTC WiFi information by the internet service provider supplying 

the FTC’s WiFi functionalities is beyond the scope of this PIA. For information about the internet service provider’s 

collection and use of data, see the Zayo Customer Privacy Statement. 
2 

Although the following components are part of the FTC’s WiFi Networks, they represent a closed 

network with no Internet access and do not collect, maintain, or disseminate personally identifiable 

information (PII).

WiFi Network Description

Scanner WiFi The Scanner WiFi network provides WiFi connectivity to the FTC 

internal network for barcode scanners used to inventory FTC assets. 

Access is restricted to pre-configured, government-owned 

equipment. This network maintains the SSID, passphrase, and list of 

authorized MAC addresses of the barcode scanners used by the FTC.

 

AV WiFi The AV WiFi network provides connectivity between the handheld 

touch panels used in the large conference rooms to control the 

room’s audiovisual and other equipment. This network maintains 

the SSID, passphrase, and list of authorized MAC addresses of the 

AV components used by the FTC. 

The FTC employs monitoring and management tools to ensure the security of FTC operations, to 

protect the equipment connected to the networks, and to preserve the privacy of staff and guest users. 

The following security components are used in varying degrees on the FTC’s WiFi Networks:

Security Component Description

Authentication 

Management System 

(AMS)

AMS manages user authentication to validate access to the FTC 

WiFiand Employee Personal WiFi networks. It issues PKI 

certificates to FTC-owned workstations to allow connection to the 

FTC WiFi networks. The name of the workstation, which 

incorporates the FTC username, is collected and logged by AMS 

whenever the workstation connects to the WiFi network. PKI 

certificates for FTC mobile devices are issued by the Mobile Device 

Management System (MDMS)2 for the device and the user by 

utilizing the FTC username and password. AMS collects and logs 

the device name and IP address when the certificate is used to 

connect to the FTC WiFi network.

AMS also issues certificates to authorized personal WiFi devices to 

allow connection to the Employee Personal WiFi network. Users 

must enter their FTC username and password to acquire the 

certificate and authenticate their accounts. 

For the Guest WiFi network, AMS presents a web form to the user 

to request guest access, which is then approved by the OCIO. It also 

presents the Terms of Service pages to users for the Guest and 

Conference WiFi networks. AMS collects guest names, 

company/contact information, and guest sponsor information as part 

 

2 For more information on the Mobile Device Management System (MDMS), refer to the MDMS PIA online at 

www.ftc.gov/privacy. 
3 

of the request forms for the Guest WiFi network. This information 

is used to create an electronic request for review. Upon arrival, 

AMS will assign a PIN to the guest that is valid for the duration of 

their visit. During the day’s activity, the system will collect and 

retain the MAC address of the guest device for the duration of time 

that the guest is connected to the WiFi. For each day’s initial 

collection, the system uses each Guest WiFi and Conference WiFi

user’s acceptance of the Terms of Service for network use to 

determine whether access to the Guest or Conference WiFi should 

be provided. 

WiFi Firewall3 The WiFi Firewall controls the incoming and outgoing network 

traffic by analyzing the data packets and determining whether or not 

they should be allowed through based on a set of rules. The rules 

prevent communications between the various WiFi networks and 

between devices on each network. The WiFi Firewall logs IP header 

information for network activity.

Wired Firewall The Wired Firewall controls the incoming and outgoing network 

traffic by analyzing the data packets and determining whether or not 

they should be allowed through based on a set of rules. This firewall 

is used to prevent unauthorized inbound traffic from accessing the 

WiFi networks from the Internet. The Wired Firewall logs IP header 

information for network activity. 

Intrusion Prevention 

& Rogue Device 

Detection

Intrusion Prevention & Rogue Device Detection continually 

monitors the WiFi Networks; detects, classifies and isolates 

unauthorized WiFi Access Points; and protects FTC WiFi Networks 

against denial-of-service (DoS) and client attacks. It collects records 

of unauthorized WiFi device activity (SSID, MAC address, 

frequency, associations with FTC equipment (if any), time of 

detection, and which Access Points detected the activity, thereby 

implying a general location of the unauthorized device) that may 

represent an intentional network intrusion within FTC premises and 

its WiFi perimeter.

Content Filtering Content Filtering restricts access to certain types of Internet content 

(e.g., gambling, adult entertainment, known malware sites, etc.). The 

levels of filtering vary according to the purpose of the WiFi

network. Content filtering creates and collects records of blocked 

access to prohibited Internet sites. Records are collected by 

username for FTC WiFi Networks and IP address for Employee, 

Guest, and Conference WiFi networks. 

 

3 Firewalls determine access based on the contents of the IP header relative to configured rules and the protocol and 

ports employed. 
4 

1.2 What specific legal authority allows for the collection, maintenance, or 

dissemination of information for this project/system? 

The Federal Information Security Modernization Act of 2014. 

 

2 Data Type, Sources, and Use

2.1 Specify in the table below what types of personally identifiable information (PII)4

may be collected or maintained in the system/project. Check all that apply. 

PII Elements: This is not intended to be an exhaustive list. Specify other categories of PII as 

needed.

Full Name

Date of Birth

Home Address

Phone Number(s)

Place of Birth

Age

Race/ethnicity

Alias

Sex

Email Address

Work Address

Taxpayer ID

Credit Card Number

Facsimile Number

Medical Information

 Education Records

Social Security Number 

Mother’s Maiden Name 

Biometric Identifiers (e.g., 

fingerprint, voiceprint)

Audio Recordings

Photographic Identifiers 

(e.g., image, x-ray, video)

Certificates (e.g., birth, 

death, marriage, etc.)

Legal Documents, Records, 

Notes (e.g., divorce decree, 

criminal records, etc.)

Vehicle Identifiers (e.g., 

license plates)

Financial Information (e.g., 

account number, PINs, 

passwords, credit report, 

etc.)

Geolocation Information

(within FTC spaces only)

Passport Number

User ID

Internet Cookie Containing 

PII

Employment Status, 

History, or Information

Employee Identification 

Number (EIN)

Salary

Military Status/Records/ ID 

Number

IP/MAC Address

Investigation Report or 

Database

Driver’s License/State ID 

Number (or foreign country 

equivalent)

Other (Please Specify): 

Passphrase 

 

2.2 What types of information other than PII will be collected, disseminated, or 

maintained by the project/system? Provide a general description below and be sure 

to include all data elements.

For each of the various WiFi networks, the Service Set Identifier (SSID) is maintained by the 

network. The Authentication Management System (AMS) collects company/contact information 

along with guest names in order to create an electronic request for review. For each day’s initial 

 

4 Per OMB M-07-16, personally identifiable information (PII) refers to information which can be used to distinguish 

or trace an individual’s identity, such as their name, social security number, biometric records, etc. alone, or when 

combined with other personal or identifying information which is linked or linkable to a specific individual, such as 

date or place of birth, mother’s maiden name, etc. 
5 

connection, the system uses each guest and conference user’s acceptance of the Terms of Service 

for network use to determine whether access to the Guest or Conference WiFi should be 

provided.. The Intrusion Prevention & Rogue Device Detection collects records of unauthorized 

WiFi device activity (SSID, MAC address, frequency, associations with FTC equipment (if any), 

time of detection, and which Access Points detected the activity, thereby implying a general 

location of the unauthorized device) that may represent an intentional intrusion within FTC 

premises and its WiFi perimeter. 

2.3 What is the purpose for collection of the information listed above? 

Information collected by the WiFi Networks is maintained for the purposes of controlling access to 

the FTC’s network, as well as to maintain a current list of authorized users (guest users and staff 

members). For guest users, the account shuts down at the end of the last day for which they need 

access, but the data is retained for a maximum of 30 days after that point. Information collected for 

system security purposes is used by authorized system administrators to investigate potential 

security threats and to respond to supervisory requests concerning staff behavior. Such information

may be audited, as needed. 

Security Component Reason for Collection, Use and Maintenance 

Authentication Management 

System (AMS)

The system queries PKI certificates to validate access to the FTC 

WiFi and Employee Personal WiFi networks.

The system collects guest names, company/contact information, 

and guest sponsor information as a part of the review and 

approval process for guest access. The MAC address of the guest 

device is retained for the duration of the user’s connection to the 

guest WiFi to streamline the process for the guest.

The system uses a guest user’s or conference user’s acceptance 

of the Terms of Service to determine whether network access 

will be granted. 

WiFi Firewall The WiFi Firewall logs IP header information for network 

activity to monitor and document activity that violates FTC 

policy or indicates network malfunction.

Wired Firewall The Wired Firewall logs IP header information for network 

activity to monitor and document activity that violates FTC 

policy or indicates network malfunction.

Intrusion Prevention & 

Rogue Device Detection

Records generated by Intrusion Prevention & Rogue Device 

Detection are maintained to monitor and document activity that 

may represent an intentional network intrusion on FTC premises.

Content Filtering Records generated by Content Filtering activities are maintained 

to monitor and document blocked access to prohibited Internet 

sites by WiFi Network users.

 
6 

2.4 What are the sources of the information in the system/project? How is the 

information collected?

For all of the FTC’s WiFi Networks, the information is entered using the administrative console 

of the respective WiFi controllers. Additionally, the Guest WiFi network collects guests’ MAC 

addresses as their device connects to the Guest Network. 

Source of Data Type of Data Provided & How It Is Collected

System Administrators System administrators set the SSID for all the WiFi networks in the 

FTC’s system. For certain networks such as the Employee Personal 

WiFi, Guest WiFi, Conference WiFi, Scanner WiFi, and AV WiFi, 

system administrators set the passphrase as well as the SSID in order 

to issue certificates to the WiFi network users. They also set up 

PINs for the Guest WiFi and Conference WiFi networks. For the 

Scanner and AV WiFi networks, system administrators are also 

responsible for entering the authorized MAC addresses of the 

barcode scanners and AV components.

 

Authentication 

Management System 

The Authentication Management System queries FTC-issued PKI 

certificates to validate device access to the FTC WiFi and Employee 

Personal WiFi networks. The PKI certificate is presented to the 

system by the WiFi device as part of the authentication process. 

o FTC Workstations – PKI device certificate is issued by the 

Windows Certificate Authority when the workstation joins 

the domain. This certificate can only be seen by 

administrators. Per FTC policy, workstation names include 

the username of the person to whom the workstation is 

assigned. 

o FTC Mobile Devices – PKI device certificate is issued by 

MDMS.

o User’s Personal Devices – PKI user certificate is issued by 

the Authentication Management System when the approved 

user connects his/her device (i.e., to the EPWN) and 

manually enters his/her FTC username and password. 

Guest information is collected through a website hosted on the 

Authentication Management System. Users or sponsors enter Guest 

names, company/contact information, and Guest sponsor 

information as part of the request form. Upon approval, the System 

assigns a PIN to the Guest that is valid for the duration of their visit. 

The MAC address is a characteristic of the user device and is 

provided by the device as a part of the basic network functionality. 

Acceptance of Terms of Service is submitted by each Guest or 

Conference user on a daily basis through a website hosted on the 

system. 
7 

WiFi Firewall The WiFi Firewall logs of IP header information are generated as a 

part of communications on the WiFi Networks. Network activity is 

collected as part of the normal operating process of the WiFi

Firewall.

Wired Firewall The Wired Firewall logs of IP header information are generated as a 

part of communications on the WiFi Networks. Network activity is 

collected as part of the normal operating process of the Wired 

Firewall. 

Intrusion Prevention & 

Rogue Device Detection

Intrusion Prevention & Rogue Device Detection generate records of 

unauthorized WiFi device activity within FTC premises and its WiFi

perimeter. Rogue Device information is created when an unapproved 

WiFi Access Point (one that attempts and/or provides unauthorized 

WiFi connection to the FTC networks) is detected by the system. 

Network activity is analyzed as part of the normal operating process 

of the Intrusion Protection system. Activity records of suspected 

rogue devices are logged automatically.

Content Filtering Content Filtering activities generate records of Internet use. Records 

are filtered by user name for FTC WiFi Networks and IP address for 

non-FTC WiFi networks. Blocked accesses to prohibited Internet 

sites are logged automatically, as part of the normal operating 

process of the Content Filtering system. 

3 Data Access and Sharing

3.1 In the table below, specify the systems/applications and groups (both FTC and nonFTC) that will have access to or share data in the system/project. 

Data Will Be Accessed 

By and/or Provided To: How and Why the Data Will Be Accessed/Shared

FTC Staff and 

Contractors

All information collected is directly accessible only by authorized 

system administrators for authorized purposes. In addition, 

information regarding unapproved inappropriate activity may be 

requested by the FTC Office of General Counsel (OGC), Human 

Capital Management Office (HCMO), and/or the Office of the 

Inspector General (OIG) as part of an investigation. Information

regarding security-related issues may be provided to the appropriate 

FTC Cybersecurity personnel within the OCIO. 

FTC WiFi is accessible for all FTC-issued laptops using the PKI 

certificate issued when the workstation is connected to the domain. 

FTC staff and contractors must sign the FTC Rules of Behavior and 

use of WiFi Networks is subject to supervisor approval. Access is 

limited to authorized devices, and access to device configuration 

(except for employee personal devices) is restricted to administrative 

personnel, as documented in standard operating procedures. 
8 

External non-FTC 

Entities

In some cases, information regarding potential security-related 

issues may be provided to the Department of Homeland Security 

(DHS) and the US Computer Emergency Response Team (USCERT). Information collected by the FTC’s WiFi Networks is not 

routinely shared with outside entities, but may be shared, if 

necessary, where authorized or required by law (e.g., confidential 

disclosures to other law enforcement authorities for investigations 

and proceedings, mandatory release of information that is not 

privileged or exempt from Freedom of Information Act (FOIA) 

requests, discovery in litigation, subpoenas or other compulsory 

process, official requests of Congress or the General Accountability 

Office (GAO), etc.). 

To use the Employee Personal WiFi on an Android device, users 

must download the Aruba QuickConnect app. This app may request 

access to information on a user’s personal device. Any information 

gathered by the QuickConnect app is not shared with the FTC, and 

the QuickConnect vendor’s use of such information is beyond the 

scope of this PIA. For information on the QuickConnect app, see 

the Aruba Clearpass Quickconnect Data Sheet or information 

available on Google Play. 

This PIA discusses how the FTC collects and uses information 

affiliated with its WiFi networks: any collection or use of FTC WiFi 

information by the internet service provider supplying the FTC’s 

WiFi functionalities is beyond the scope of this PIA. For information 

about the internet service provider’s collection and use of data, see 

the Zayo Customer Privacy Statement. 

3.2 Do contractors and/or third party service providers have access to data in the 

project/system? If yes, explain what privacy requirements are in place to ensure 

that data is properly protected. 

There are no third party service providers who have administrative access to the WiFi Networks 

or the security components used to monitor the networks. However, see the chart in 3.1 above for 

information about the QuickConnect app and internet service provider data collection. FTC 

contractors who are employed by the agency are subject to the same policies and guidelines that 

FTC staff members must follow. As such, contractors must adhere to existing FTC guidelines 

when using the WiFi Networks and comply with established Rules of Behavior. 

Not Applicable

3.3 If you answered “yes” to 3.2, describe the privacy incident response plan maintained 

by the contractor’s organization or third party service provider. 

Not Applicable. 
9

4 Notice and Consent

4.1 How are individuals provided with notice prior to the collection of their PII? If 

notice is not provided, explain why.

Notice is provided via (check all that apply):

Privacy Act Statement ( Written Oral)

FTC Website Privacy Policy

Privacy Notice (e.g., on Social Media platforms)

Login banner

Other (explain): Individuals, including members of the public, who choose to use the 

Guest or Conference WiFi Networks are given notice about the FTC’s WiFi network 

monitoring in writing when acknowledging the online Terms of Service for those 

networks. This PIA also acts to provide public notice of the configuration and security 

information collected by the networks.

Notice is not provided (explain): _________________________________________________

4.2 Do individuals have the opportunity to decline to provide information or to consent 

to particular uses of their information (other than required or authorized uses)? 

Individuals are not required to provide their information; however, if they wish to utilize the WiFi

Network services, they must provide the necessary information. For example, if FTC staff 

members wish to use the FTC WiFi Network or the Employee Personal WiFi network, then they 

must provide the required information. Similarly, individuals may choose to use their own 

communication solutions when visiting the FTC as guests or conference attendees; however, if 

guests or conference participants wish to use the Guest WiFi or Conference WiFi networks, then 

they must provide the required information. 

Once individuals choose to use any component of the FTC WiFi Networks, they cannot decline to 

provide information necessary for the security components associated with that WiFi network. 

Individuals do not have the right to consent to particular uses of the information except by 

declining to use the WiFi Networks provided by the FTC. 

 

4.3 Are there procedures in place to allow individuals access to their personally 

identifiable information? Explain. 

Individuals do not have direct access to information collected and issued by the WiFi Networks. 

FTC employees and contractors may contact the FTC Enterprise Service Desk (Help Desk) and 

request their account information. Guest users and Conference attendees may request access to 

collected information, if any, through the FTC FOIA/Privacy Act Office, www.ftc.gov/aboutftc/foia/foia-request. 
10

4.4 Are there procedures in place to allow individuals the ability to correct inaccurate 

or erroneous information? What is the process for receiving and responding to 

complaints, concerns, or questions from individuals? Explain. 

As stated in 4.3 above, individuals do not have direct access to information collected about 

themselves. FTC employees and contractors can receive their account information by calling the 

Enterprise Service Desk (Help Desk). If a Guest or Conference attendee wishes to request access 

to collected information, he/she may submit a request through the FOIA/Privacy Act Office, 

www.ftc.gov/about-ftc/foia/foia-request. 

If an individual is aware that the information collected about them is inaccurate (e.g., wrong 

email address), then he/she can contact OCIO to correct or update the information as necessary. 

5 Data Accuracy and Security

5.1 Are there procedures in place to ensure that the information maintained is accurate, 

complete, and up-to-date? 

The minimal information collected about users is maintained by the Authentication Management 

System. FTC staff members may contact the FTC Help Desk to request their account 

information. If there is any inaccuracy in the information maintained, the individual can request 

corrections, and OCIO will update the information accordingly. Information access and 

amendment procedures for FTC WiFi information may also be governed by FOIA and the 

Privacy Act. 

5.2 Are there administrative procedures and technical safeguards in place to protect the 

data in the system/project? What controls are in place to ensure proper use of the 

data? Please specify.

FTC administrative staff members are bound by FTC policy regarding network and usage data 

collected by the monitoring and security tools mentioned in Section 1. Logs created by these 

tools are audited, as needed, as part of overall infrastructure security management. Any questions 

regarding the security of the system should be directed to the FTC’s Chief Information Security 

Officer (CISO). The following technical safeguards are employed to prevent misuse of data 

transiting the network:

Security Component Technical Safeguards

Authentication Management 

System

The Authentication Management System provides centralized 

management of rules and access control for the various WiFi

networks. It enables the use of PKI certificates across many of 

the networks, ensuring stronger and more efficient access 

control. 
11

Security Component Technical Safeguards

WiFi Firewall The WiFi firewall controls the incoming and outgoing network 

traffic by analyzing the data packets and determining whether or 

not they should be allowed through, based on a set of rules. This 

tool prevents traffic flow between the FTC WiFi networks and 

between connected WiFi devices on the same FTC WiFi

network. 

Wired Firewall The wired firewall controls the incoming and outgoing network 

traffic by analyzing the data packets and determining whether or 

not they should be allowed through, based on a set of rules. This 

firewall is used to prevent inbound traffic from the Internet to 

the WiFi networks. 

Intrusion Prevention & Rogue 

Device Detection

Intrusion Prevention & Rogue Device Detection continually 

monitors the networks; detects, classifies and contains rogue 

Access Points; and protects against denial-of-service (DoS) and 

client attacks. 

Content Filtering Content filtering is used to restrict access to certain types of 

Internet content from the various WiFi networks. The levels of 

filtering vary by the network purpose.

 

5.3 Has the system/project undergone the appropriate security risk assessment and 

received authority to operate?

The FTC’s WiFi Network system is a component of the Data Center General Support System5

(GSS). As such, FTC WiFi networks are covered by the current risk assessment and 

authorization to operate as applicable for the Data Center GSS. 

5.4 Is PII used in the course of system testing, training, or research? If so, what steps 

are taken to minimize and protect PII during this process? 

Aside from instances when system administrators used their own PII for setup purposes, 

PII is not used in the course of system testing, training, or research. 

6 Data Retention and Disposal

6.1 Specify the period of time that data is retained in the system/project. What are the 

specific procedures for disposing of the data at the end of the retention period? 

Information collected by the FTC WiFi and Employee WiFi is deleted 30 days after an employee 

leaves the agency or an employee’s WiFi access is terminated. Guest configuration information 

and guests’ requests for access are automatically deleted after 30 days. 

 5 For more information on the Data Center GSS, refer to the PIA available at www.ftc.gov/privacy. 
12

As specified by the National Archives and Records Administration (NARA) in General Records 

Schedule (GRS) 3.2, Information Systems Security Records, item 010, system and data security 

records, security records are maintained for as long as needed for agency/IT administrative 

purposes to ensure a continuity of security controls throughout the life of the system. Per FTC 

policy, the security records are maintained for a minimum of six months.

In accordance with NARA GRS 3.2, item 020, Computer security incident handling, reporting, 

and follow-up records, security incident records (e.g., attempts to gain unauthorized access to 

FTC WiFi Networks) will be retained for a minimum of three years after all necessary follow-up 

actions have been completed. 

7 Website Privacy Evaluation

7.1 Does the project/system employ the use of a website? If so, describe any tracking 

technology used by the website and whether the technology is persistent or 

temporary (e.g., session cookie, persistent cookie, web beacon). Describe the 

purpose of using such tracking technology. 

Not Applicable 

The WiFi Networks and the respective security components do not use tracking technology on 

behalf of the agency. The FTC’s Authentication Management System (AMS), however, has the 

ability to log which users are no longer approved to access any of the WiFi Networks; when 

Guest users connect to the Guest WiFi network; and whether Guest users have appropriately 

accepted the Terms of Service. AMS collects personal information required for Guests to use the 

Guest WiFi network and collects user acknowledgement of the Terms of Service for the Guest 

and Conference WiFi networks. No other FTC WiFi Network component collects personal 

information through a website. Persistent tracking technology is not applicable. 

8 Privacy Risks and Evaluation

8.1 Considering the type of information collected and sources of collection, what 

privacy risks were identified and how were these risks mitigated? 

Risk Mitigation Strategy

User information may be 

accessed, shared, used, 

maintained, or monitored 

by unauthorized persons 

or for unauthorized 

purposes. 

All collection and monitoring activities by the FTC WiFi Networks 

and associated tools are related to securing the networks. To 

mitigate privacy risks, the review of network activity is limited to 

authorized security personnel and does not include routine user-level 

data review, unless there is evidence of a potential security incident, 

in which case the additional user-level data may be reviewed by 

authorized FTC personnel for authorized purposes. Configurations 

and any information logged by components of the FTC WiFi

Networks are protected by access control lists at the network level 

and require administrative accounts and passwords to access or alter 

information. 

The FTC’s WiFi Networks are also encrypted and password-
13

protected, but as with any WiFi network, the risk of intrusion from

outside entities exists. Users should exercise caution when browsing 

the web and avoid suspicious content to protect their information 

and their devices. The WiFi Networks are configured to prevent 

access to inappropriate sites, such as pornographic or gambling sites, 

and users are at their own risk while browsing other sites. The 

monitoring technologies help moderate these risks (although the risk 

of acquiring viruses or other malware cannot be completely 

eliminated). 

 

8.2 Does the project/system employ the use of automated privacy controls or enhanced 

capabilities designed to support privacy? Explain. 

There are systematic lock-outs in place to deter unauthorized access to security components 

monitoring the WiFi Networks. For example, after four repeated incorrect login attempts of the 

Authentication Management System, a system user will be locked out of his/her account until an 

administrator resets the account. 

8.3 Has a Privacy Act System of Records Notice (SORN) been published in the Federal

Register for this system/project? If so, list the applicable SORN(s). 

The information maintained is covered by existing Privacy Act System of Records Notices 

(SORNs): VII-3 -- Computer Systems User Identification and Access Records, VII-5 -- Property 

Management System. Information may also be incorporated into VII-7 -- Information 

Technology Service Ticket System, to the extent necessary to help track and resolve individual or 

network service issues. 

8.4 How does the project/system ensure that the information is collected, used, stored, 

or disseminated in accordance with stated practices in this PIA? 

FTC administrative staff members are bound by FTC policy regarding network and usage data 

collected by the monitoring and security tools put in place to prevent misuse of data transiting the 

network. Logs created by these tools are audited as needed as part of overall infrastructure 

security management.