Executive Order 13636

Privacy and Civil Liberties

Assessment Report

Compiled by: 

The DHS Privacy Office and the Office for Civil Rights and Civil Liberties

Department of Homeland Security 

July 2016 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

2 | Page

FOREWORD 

July 14, 2016 

We are pleased to present the 2016 Executive Orders 13636 and 13691 Privacy and Civil 

Liberties Assessments Report. On February 12, 2013, President Obama issued Executive Order 

13636, Improving Critical Infrastructure Cybersecurity and Presidential Policy Directive 21 

(PPD-21), Critical Infrastructure Security and Resilience, directing federal departments and 

agencies to work together and with the private sector to strengthen the security and resilience of 

the Nation’s critical infrastructure. Specifically, Executive Order 13636 requires federal 

agencies to develop and incentivize participation in a technology-neutral cybersecurity 

framework, and to increase the volume, timeliness, and quality of the cyber threat information 

they share with the private sector.

In addition, on February 13, 2015, President Obama issued Executive Order 13691, Promoting 

Private Sector Cybersecurity Information Sharing, which builds upon the foundation established 

by Executive Order 13636 and PPD-21. Executive Order 13691 specifically acknowledges that 

organizations engaged in the sharing of information related to cybersecurity risks and incidents 

play an invaluable role in the collective cybersecurity of the United States. Therefore, the 

Executive Order encourages the voluntary formation of such information sharing organizations, 

to establish mechanisms to continually improve the capabilities and functions of these 

organizations, and to better allow these organizations to partner with the Federal Government on 

a voluntary basis. 

Section 5 of both Executive Orders 13636 and 13691 require that federal agencies coordinate 

their activities under each Executive Order with their senior agency officials for privacy and civil 

liberties to ensure that appropriate protections for privacy and civil liberties are incorporated into 

such activities. Senior agency officials for privacy and civil liberties are also required to 

annually assess the privacy and civil liberties impacts of the activities their respective 

departments and agencies have undertaken pursuant to each Executive Order. The senior 

officials must submit those assessments to the Department of Homeland Security (DHS) Office 

for Civil Rights and Civil Liberties and the DHS Privacy Office for compilation and publication 

in this Privacy and Civil Liberties Assessment report. 

This third annual report provides assessments of activities under Executive Orders 13636 and 

13691 that occurred in fiscal year 2015. With regard to Executive Order 13636, this report 

builds on last year’s report, focusing on programs or activities that are new or have substantially 

changed within the last fiscal year as a result of the Executive Order’s implementation. Since 

Executive Order 13691 was issued in February 2015, DHS is the only the department or agency 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

3 | Page

that performed reportable activities pursuant to the Order in fiscal year 2015. These activities are 

discussed in DHS’s section of this Privacy and Civil Liberties Assessment report. 

The chart below provides an overview of the departments and agencies that provided input for 

this year’s report pursuant to Executive Order 13636. We note that not all agencies were 

required to assess all sections of Executive Order 13636. To view the privacy and civil liberties 

assessments conducted by departments and agencies for previous Executive Order 13636 Privacy 

and Civil Liberties Assessments Reports, please visit: https://www.dhs.gov/cybersecurity-andprivacy. 

2016 Executive Order 13636 Section 5 Reports by Department and Topic 

 Department 

of 

Homeland 

Security

(DHS)

Department 

of Treasury

(Treasury)

Department 

of Defense

(DoD)

Department 

of Justice

(DOJ)

Department

of Health 

and Human 

Services

(HHS)

Department 

of Energy

(DOE)

Office of 

the Director 

of National 

Intelligence

(ODNI)

4(a) 

Cybersecurity 

Information 

Sharing

X X X 

4(b) 

Dissemination 

of Cyber 

Threat 

Reports

X X 

4(c) Enhanced 

Cybersecurity 

Services / 

Defense 

Industrial Base 

Program

X X 

4(d) Private 

Sector 

Clearance 

Program

X X 

9(a)/9(c) 

Critical 

Infrastructure 

Identification & 

Notification

X 

Other X X 

Our offices – the DHS Office for Civil Rights and Civil Liberties and the DHS Privacy Office – 

coordinated with the senior agency officials for privacy and civil liberties for each reporting 

agency. This coordination was accomplished with the goal of the reporting senior agency 

officials assessing and reporting on their respective agencies in an objective and independent 

manner, consistent with their own authorities and policies. We did not direct the officials in the 

selection of activities for assessment, their assessment methods, or in the drafting of their reports. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

4 | Page

The reporting senior agency officials did, however, work jointly to produce this report, sharing 

best practices, following similar formats, and coordinating assessment coverage for sections of 

Executive Orders 13636 and 13691 being implemented in multiple agencies. 

Our offices also facilitated communications among the senior agency officials and the United 

States Privacy and Civil Liberties Oversight Board (“the Board”) with regard to the privacy and 

civil liberties assessments conducted under Executive Order 13636. Each agency, however, 

worked independently and directly with the Board in its consultative role, as specifically required 

by Section 5 of Executive Order 13636, to maximize the senior officials’ latitude for disclosure 

and responsiveness to the Board during this process. 

Each agency’s report reflects its own senior agency officials’ determination regarding which 

activities were required under Executive Orders 13636 and 13691, or were otherwise deemed 

appropriate to be assessed. In future years, as the activities required under each Executive Order 

are fully implemented across the U.S. Government, senior agency officials will continue to 

identify, assess, and report on the privacy and civil liberties impacts of new and/or substantially 

altered programs and activities.

 

 

 

 

Megan H. Mack 

Officer for Civil Rights and Civil Liberties 

Karen L. Neuman 

Chief Privacy Officer 

 

 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

5 | Page

TABLE OF CONTENTS

FOREWORD ............................................................................................................ 2

PART I: DEPARTMENT OF HOMELAND SECURITY................................. 6

PART II: DEPARTMENT OF THE TREASURY............................................23

PART III: DEPARTMENT OF DEFENSE.......................................................46

PART IV: DEPARTMENT OF JUSTICE.........................................................50

PART V: DEPARTMENT OF HEALTH AND HUMAN SERVICES...........61

PART VI: DEPARTMENT OF ENERGY.........................................................66

PART VII: OFFICE OF THE DIRECTOR OF NATIONAL 

INTELLIGENCE ...................................................................................................69
2016 EO 13636 Privacy & Civil Liberties Assessment Report

6 | Page

PART I: DEPARTMENT OF HOMELAND SECURITY
2016 EO 13636 Privacy & Civil Liberties Assessment Report

7 | Page

I. Introduction 

Background and Scope 

Section 5 of Executive Orders 13636 and 13691 require the DHS Chief Privacy Officer and 

Officer for Civil Rights and Civil Liberties to assess the privacy and civil liberties impacts of the 

activities that the Department of Homeland Security (DHS or Department) undertakes pursuant 

to these Executive Orders and to include those assessments, together with recommendations for 

mitigating identified privacy risks, in an annual public report. In addition, the DHS Privacy 

Office and the Office for Civil Rights and Civil Liberties (CRCL) are charged with coordinating 

and compiling in a single published report the Privacy and Civil Liberties assessments conducted 

by Privacy and Civil Liberties officials from other Executive Branch departments and agencies

with reporting responsibilities under the Executive Orders. 

This year’s assessment covers Department activities conducted under Executive Orders 13636 

and 13691 during fiscal year 2015. Specifically, this year’s report provides updates to previous 

assessments conducted under Executive Order 13636 Sections 4(b), (c), and (d), including 

explaining instances where implementation approaches have changed. In addition, the DHS 

Privacy Office and CRCL report the activities that the Department has conducted as a result of 

Executive Order 13691’s issuance in February 2015. 

As in the previous 2014 and 2015 Executive Order 13636 assessments, the scope of this year’s 

assessment is limited to those DHS activities that were undertaken as a result of Executive 

Orders 13636 and 13691 or were substantially altered by these orders. Section 5 of both 

Executive Orders 13636 and 13691 direct the assessment of “the functions and programs 

undertaken by DHS as called for in this order,” and the scope of the assessment is therefore 

limited to those functions and programs, rather than attempting to assess the many DHS 

cybersecurity programs and activities conducted under other authorities. Attempting to include 

that wide array of programs and activities within this assessment would be impractical, straining 

oversight office resources, and diluting the in-depth focus on the activities that are driven by 

Executive Orders 13636 and 13691. More information on DHS’s cybersecurity responsibilities 

and activities is available at: http://www.dhs.gov/topic/cybersecurity.

DHS Privacy Office

The Privacy Office is the first statutorily created privacy office in any federal agency, as set forth 

in Section 222 of the Homeland Security Act (Homeland Security Act).

1

 The mission of the 

Privacy Office is to protect all individuals by embedding and enforcing privacy protections and 

transparency in all DHS activities. The Privacy Office works to minimize the impact of DHS 

programs on an individual’s privacy, particularly an individual’s personal information, while 

achieving the Department’s mission to protect the homeland. The Chief Privacy Officer reports 

directly to the Secretary of Homeland Security.

 

1 6 U.S.C. § 142
2016 EO 13636 Privacy & Civil Liberties Assessment Report

8 | Page

The DHS Privacy Office accomplishes its mission by focusing on the following core activities:

• Requiring compliance with federal privacy and disclosure laws and policies in all DHS 

programs, systems, and operations, including cybersecurity-related activities;

• Centralizing Freedom of Information Act (FOIA) and Privacy Act operations to provide 

policy and programmatic oversight, to support operational implementation within the 

DHS components, and to ensure the consistent handling of disclosure requests; 

• Providing leadership and guidance to promote a culture of privacy and adherence to the 

Fair Information Practice Principles (FIPPs) across the Department;

• Advancing privacy protections throughout the Federal Government through active 

participation in interagency fora;

• Conducting outreach to the Department’s international partners to promote understanding 

of the U.S. privacy framework generally and the Department’s role in protecting 

individual privacy; and, 

• Ensuring transparency to the public through published materials, reports, formal notices, 

public workshops, and meetings.2 

DHS Office for Civil Rights and Civil Liberties

The Office for Civil Rights and Civil Liberties supports the Department's mission to secure the 

nation while preserving individual liberty, fairness, and equality under the law. The Officer for 

CRCL reports directly to the Secretary of Homeland Security. CRCL integrates civil rights and 

civil liberties into all of the Department’s activities by:

• Promoting respect for civil rights and civil liberties in policy creation and implementation 

by advising Department leadership and personnel; 

• Communicating with individuals and communities whose civil rights and civil liberties 

may be affected by Department activities, informing them about policies and avenues of 

redress, and promoting appropriate attention within the Department to their experiences 

and concerns; 

• Investigating and resolving civil rights and civil liberties complaints filed by the public 

regarding Department policies or activities, or actions taken by Department personnel; 

and, 

• Leading the Department's equal employment opportunity programs and promoting 

workforce diversity and merit system principles.3

 

 

2 Detailed information about DHS Privacy Office activities and responsibilities, including Privacy Impact 

Assessments conducted by the Privacy Office for DHS cybersecurity-related efforts, is available at 

http://www.dhs.gov/privacy.

3 Detailed information about the activities and responsibilities of the DHS CRCL is available at 

http://www.dhs.gov/office-civil-rights-and-civil-liberties.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

9 | Page

DHS Methodology for Conducting Executive Order (EO) 13636/13691 Assessments 

Executive Order 13636 and Executive Order 13691 direct senior agency privacy and civil 

liberties officials of agencies engaged in activities under the orders to perform an “evaluation of 

activities against the Fair Information Practice Principles (FIPPs) and other applicable privacy 

and civil liberties policies, principles, and frameworks.” DHS has evaluated its activities against 

the FIPPs and other applicable privacy and civil liberties policies, principles, and frameworks. 

More information on the evaluation process is described below. 

The DHS Privacy Framework

The FIPPs, which are rooted in the tenets of the Privacy Act of 1974,4 have served as DHS’s 

core privacy framework since the Department was established. They are memorialized in the 

DHS Privacy Office’s Privacy Policy Guidance Memorandum 2008-01, The Fair Information 

Practice Principles: Framework for Privacy Policy at the Department of Homeland Security5

 and 

in DHS Directive 047-01, Privacy Policy and Compliance (July 2011).6

 The DHS 

implementation of the FIPPs is as follows:

Transparency: DHS should be transparent and provide notice to the individual regarding its 

collection, use, dissemination, and maintenance of personally identifiable information (PII). 

Technologies or systems using PII must be described in a System of Records Notice (SORN)7

and Privacy Impact Assessment (PIA)8, as appropriate. There should be no system the existence 

of which is a secret.

 

4 5 U.S.C. § 552a

5 Available at http://www.dhs.gov/xlibrary/assets/privacy/privacy_policyguide_2008-01.pdf. 6 Directive 047-01 is available at http://www.dhs.gov/xlibrary/assets/foia/privacy-policy-compliance-directive-047-

01.pdf. The Directive supersedes the DHS Directive 0470.2, Privacy Act Compliance, which was issued in October 

2005.

7 The Privacy Act requires that federal agencies issue a SORN to provide the public notice regarding personally 

identifiable information collected in a system of records. A system of records means a group of records under the 

control of the agency from which information is retrieved by the name of the individual or by some identifying 

number, symbol, or other identifying particular assigned to the individual. SORNs explain how the information is 

used, retained, and may be corrected, and whether certain portions of the system are subject to Privacy Act 

exemptions for law enforcement or national security reasons. If a SORN is required, the program manager will work 

with the Component Privacy Officer to demonstrate accountability, and to further the transparency of Department 

activities. PIAs and SORNs relevant to the Department’s activities under Executive Order Section 4 are discussed in 

the assessments reported below. The Privacy Point of Contact and Component counsel write the SORN for 

submission to the Privacy Office. The DHS Chief Privacy Officer reviews, signs, and publishes all DHS SORNs. 8 The E-Government Act and the Homeland Security Act require PIAs, and PIAs may also be required in accordance 

with DHS policy issued pursuant to the Chief Privacy Officer’s statutory authority. PIAs are an important tool for 

examining the privacy impact of IT systems, initiatives, programs, technologies, or rulemakings. The DHS PIA is 

based on the FIPPs framework and covers areas such as the scope and use of information collected, information 

security, and information sharing. Each section of the PIA concludes with analysis designed to outline any potential 

privacy risks identified in the answers to the preceding questions and to discuss any strategies or practices used to 

mitigate those risks. The analysis section reinforces critical thinking about ways to enhance the natural course of 

system development by including privacy in the early stages. PIAs are initially developed in the DHS Components, 

with input from the DHS Privacy Office. Once approved at the Component level, PIAs are submitted to the DHS 

Chief Privacy Officer for final approval. Once approved, PIAs are published on the Privacy Office website, with the 

exception of a small number of PIAs for national security systems.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

10 | Page

Individual Participation: DHS should involve the individual in the process of using PII. DHS 

should, to the extent practical, seek individual consent for the collection, use, dissemination, and 

maintenance of PII and should provide mechanisms for appropriate access, correction, and 

redress regarding DHS’s use of PII.

Purpose Specification: DHS should specifically articulate the authority which permits the 

collection of PII and specifically articulate the purpose or purposes for which the PII is intended 

to be used.

Data Minimization: DHS should only collect PII that is directly relevant and necessary to 

accomplish the specified purpose(s), and only retain PII for as long as is necessary to fulfill the 

specified purpose(s). PII should be disposed of in accordance with DHS records disposition 

schedules as approved by the National Archives and Records Administration.

Use Limitation: DHS should use PII solely for the purpose(s) specified in the notice. Sharing PII

outside the Department should be for a purpose compatible with the purpose for which the PII

was collected.

Data Quality and Integrity: DHS should, to the extent practical, ensure that PII is accurate, 

relevant, timely, and complete, within the context of each use of the PII.

Security: DHS should protect PII (in all forms) through appropriate security safeguards against 

risks such as loss, unauthorized access or use, destruction, modification, or unintended or 

inappropriate disclosure.

Accountability and Auditing: DHS should be accountable for complying with these principles, 

providing training to all employees and contractors who use PII, and auditing the actual use of 

PII to demonstrate compliance with these principles and all applicable privacy protection 

requirements.

The FIPPs govern the appropriate use of PII at the Department and are the foundation of all DHS 

privacy-related policies and activities at DHS. DHS uses the FIPPs to assess privacy risks and 

enhance privacy protections by assessing the nature and purpose of all PII collected to ensure it

is necessary for the Department’s mission to preserve, protect, and secure the homeland. The 

DHS Privacy Office applies the FIPPs to the full breadth and diversity of Department systems, 

programs, and initiatives that use PII, or are otherwise privacy-sensitive, including the 

Department’s cybersecurity-related activities. Because the FIPPs serve as the foundation of 

privacy policy at DHS, the Privacy Office works with Department personnel to complete Privacy 

Threshold Analyses (PTA) 9

, PIAs, and SORNs to ensure the implementation of the FIPPs at 

DHS. When conducting a Privacy Compliance Review (PCR)10, such as the one completed on

 9 The first step in the DHS privacy compliance process is for DHS staff seeking to implement or modify a system, 

program, technology, or rulemaking to complete a PTA. The Privacy Office reviews and adjudicates the PTA, which 

serves as the official determination as to whether or not the system, program, technology, or rulemaking is privacy 

sensitive and requires additional privacy compliance documentation such as a PIA or SORN.

10 The DHS Privacy Office exercises its authority under Section 222 of the Homeland Security Act to assure that 

technologies sustain and do not erode privacy protections through the conduct of PCRs. Consistent with the DHS 

Privacy Office’s unique position as both an advisor and oversight body for the Department's privacy sensitive 

programs and systems, the PCR is designed as a constructive mechanism to improve a program’s ability to comply 

with assurances made in existing privacy compliance documentation.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

11 | Page

the Enhanced Cybersecurity Services (ECS) program,11 the Privacy Office evaluates the 

program’s compliance with the FIPPs, any requirements outlined in its PTA, PIA, or SORN, and 

any privacy policies that are specific to that program. It is important to note, however, that 

because DHS uses the FIPPs as its foundational privacy policy framework, many DHS programs 

or activities do not require specific privacy policies aside from DHS’s Privacy Policy Guidance 

Memorandum on the FIPPs, DHS Directive 047-01 “Privacy Policy and Compliance,” and any 

specific privacy requirements documented in an applicable PTA, PIA, and/or SORN. 

Civil Rights and Civil Liberties Assessment Framework

CRCL conducts assessments using an issue-spotting approach rather than a fixed template of 

issues because the particular issues that may be presented vary greatly across programs and 

activities. This approach necessitates in-depth factual examination of a program or activity to 

determine its scope and how it is implemented. Next, CRCL considers the applicability of 

relevant individual rights protections, first evaluating compliance with those protections, then 

considering whether a program or activity should modify its policies or procedures to improve 

the protection of individual rights. As CRCL evaluates programs and activities, consideration is 

given, but not limited to, the following legal and policy parameters: 

• Individual rights and constraints on government action provided for in the Constitution of 

the United States.

• Statutory protections of individual rights, such as the Civil Rights Act of 1964, 42 U.S.C. 

§§ 1981-2000h-6. 

• Statutes that indirectly serve to protect individuals, such as the Electronic 

Communications Privacy Act, 18 U.S.C. §§ 2510-2522. 

• Executive Orders, regulations, policies, and other rules or guidelines that direct 

government action and define the government’s relationship to the individual in specific 

circumstances.

• Other sources of law or authority that may be relevant in specific instances, such as 

international law standards pertaining to human rights, or prudential guidelines 

suggesting best practices for governance of particular types of government activities.

The assessment process typically results in the evaluation of several possible individual rights 

questions raised by a program or activity. The most salient of the factual findings and policy 

concerns are then addressed in policy advice, and sometimes in a formal memorandum or similar 

document, or in a format comparable to this assessment. CRCL then works with the DHS 

elements involved, including the Department’s Office of the General Counsel, to craft workable 

policy recommendations and solutions to ensure individual rights are appropriately protected 

within the assessed program or activity. These solutions may be embedded in program-specific

policies, operating procedures, other documentation or simple changes in program activities, as 

appropriate. 

 

11 See Section III, “EO Section 4(c): Enhanced Cybersecurity Services,” for more information on the Privacy 

Compliance Review.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

12 | Page

Related DHS Privacy and Civil Liberties Cyber Activities

Our work under Executive Orders 13636 and 13691 provides further transparency into the 

Department’s cybersecurity-related activities dating back to PIAs and SORNs published in 

2004.12 In addition, the Department has sought the guidance of its Data Privacy and Integrity 

Advisory Committee (DPIAC)13 on cybersecurity-related matters. The DHS Privacy Office has 

briefed the DPIAC on cybersecurity-related matters in numerous public meetings. At the Chief 

Privacy Officer’s request, the DPIAC issued a public report and recommendations on 

implementing privacy in cybersecurity pilot programs. The report, which was issued in 

November 2012, has informed the Department’s development work in this area, and will serve as 

a guide for future assessments by the Privacy Office.

In this year’s report, as noted, the DHS Privacy Office and CRCL provide updates to previous 

assessments conducted under Executive Order 13636 Sections 4(b), (c), and (d). In addition, the 

DHS Privacy Office and CRCL report the activities that the Department has conducted under 

Executive Order 13691 since its issuance in February 2015. As the Department continues its 

implementation activities under these two Executive Orders, the DHS Privacy Office and CRCL 

will assess new activities, and provide any necessary updates to previous assessments in future 

reports.

II. EO Section 4(b): Dissemination of Reports 

The Secretary and the Attorney General, in coordination with the Director of National 

Intelligence, shall establish a process that rapidly disseminates the reports produced 

pursuant to section 4(a) of this order to the targeted entity. Such process shall also, 

consistent with the need to protect national security information, include the 

dissemination of classified reports to critical infrastructure entities authorized to receive 

them. The Secretary and the Attorney General, in coordination with the Director of 

National Intelligence, shall establish a system for tracking the production, dissemination, 

and disposition of these reports. 

Background 

In the 2015 Privacy and Civil Liberties Assessment Report, DHS reported that it participated in a 

pilot with the Federal Bureau of Investigation (FBI) to determine whether the Cyber Guardian 

system on the Secret Internet Protocol Router Network (SIPRNET) could be leveraged to track 

the production and dissemination of cyber threat reports to targeted private sector critical 

infrastructure entities. As a result of the pilot and with guidance from the National Security 

Council (NSC) staff, FBI, DHS, and the Department of Defense (DOD) developed an 

 

12 These PIAs and links to associated SORNs are available on the DHS Privacy Office’s website at 

http://www.dhs.gov/privacy-documents-national-protection-and-programs-directorate-nppd. 13 The DPIAC is a discretionary advisory committee established under the authority of the Secretary of Homeland 

Security in 6 U.S.C. § 451. The DPIAC operates in accordance with the Federal Advisory Committee Act, 5 U.S.C. 

Appendix 2. More information about the DPIAC, including all reports and recommendations, is available on the 

DHS Privacy Office website at http://www.dhs.gov/privacy-office-dhs-data-privacy-and-integrity-advisorycommittee 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

13 | Page

interagency Joint Requirements Team (JRT) to develop requirements for a system that meets the 

Section 4(b) mandate. 

Since last year’s report, the JRT did develop and formalize requirements for a system that meets 

the Section 4(b) mandate in a Section 4(b) Support Capability Requirements document. On 

April 10, 2015, the White House Inter-Agency Policy Committee accepted this requirements 

document and designated the FBI’s National Cyber Investigative Joint Task Force (NCIJTF) as 

the Implementer of the 4(b) Support Capability via the Cyber Guardian System. 

Since the White House Inter-Agency Policy Committee accepted the Section 4(b) Support 

Capability Requirements document in April 2015, the FBI has completed a Memorandum of 

Understanding (MOU) that participating federal agencies must sign in order to access/use Cyber 

Guardian and a Rules of Behavior (ROB) document that individual users of the system must sign 

and with which they must abide. DHS has signed the MOU and all DHS employees currently 

using the Cyber Guardian system have signed the ROB document as well as completed training 

on the Cyber Guardian system. Currently, Cyber Guardian enables government agencies with 

cyber missions to be aware of and de-conflict cyber incidents. Moving forward, Cyber Guardian 

is the planned platform for cyber incident reports to be assimilated and made available for 

dissemination to the private sector, and is intended to have the capability to disseminate both 

unclassified and classified reports to critical infrastructure entities authorized to receive them. 

Because the NCIJTF maintains and manages the Cyber Guardian system from an engineering 

and maintenance perspective, additional information on the Cyber Guardian system and its 

policies may be found in Section 4(b) of this year’s Department of Justice (DOJ) Privacy and 

Civil Liberties Assessment Report. 

While the NCIJTF maintains and manages the Cyber Guardian system to track the production 

and dissemination of cyber threat reports to targeted private sector critical infrastructure entities, 

DHS continues to develop, receive, and handle cyber threat reports specific to targeted private 

sector critical infrastructure entities before that information is entered into the Cyber Guardian 

system. This year’s report summarizes DHS’s cyber threat reporting under Section 4(b) of 

Executive Order 13636 and provides a FIPPs assessment conducted by the DHS Privacy Office 

regarding the cyber threat reporting process.

DHS’s Cyber Threat Reporting under Section 4(b)

Typically, DHS law enforcement components discover cyber threat information, specific to a 

targeted entity, during the course of an investigation. DHS may, however, also encounter cyber 

threat information in other mission-related activities, such as the protection of federal civilian 

networks and cyber threat analysis. In addition, targeted private sector entities may voluntarily 

submit cyber threat information to DHS through the National Cybersecurity and 

Communications Integration Center (NCCIC) in connection with efforts to protect information 

systems from known or suspected cybersecurity threats, mitigate such cybersecurity threats, or 

respond to cyber incidents. DHS shares cyber threat information within the Cyber Guardian 

system for the purposes of tracking the production, dissemination, and disposition of significant 

threat reports shared under Section 4 of the Order with U.S. private sector entities so that these 

entities may better protect and defend themselves against cyber threats and to facilitate proper 

coordination of victim notifications, in accordance with Section 4(b) of Executive Order 13636 

and the Cyber Guardian MOU with FBI. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

14 | Page

Privacy Assessment

FIPPs Analysis

Transparency: As noted in the 2014 Report in reference to 4(a) activities, DHS has published a 

number of PIAs explaining how it currently collects, uses, maintains, and disseminates cyber 

threat information, including any PII.14 These PIAs provide generalized notice of DHS’s cyber 

activities as they relate to cyber threats. 

 

The PIA that covers the reporting and collection of cyber threat information from the public and

private sector relevant to 4(b) activities is DHS/NPPD/PIA-026 National Cybersecurity 

Protection System (NCPS), July 30, 2012. NCPS is an integrated system for intrusion detection, 

analysis, intrusion prevention, and information sharing capabilities used to defend the federal 

civilian government’s information technology infrastructure from cyber threats. The National 

Protection and Programs Directorate (NPPD) conducted this PIA because PII may be collected 

by NCPS, or through submissions of known or suspected cyber threats received by the NCCIC

for analysis. 

Cyber threat information collected by DHS, specific to targeted private sector critical 

infrastructure entities, is shared with other Federal agencies that have cybersecurity 

responsibilities through the FBI’s Cyber Guardian system, as detailed in DOJ’s Privacy and Civil 

Liberties Assessment Report of 4(b) activities. Cyber Guardian is employed to track the 

production, dissemination, and disposition of threat reports shared under Section 4 of the Order 

with U.S. private sector entities so that these entities may better protect and defend themselves 

against cyber threats and to facilitate proper coordination of victim notifications. 

Data Minimization: Data minimization is at the core of DHS’s cyber threat reporting process 

under Section 4(b) of the Order. As described in the Cyber Guardian MOU with FBI, Cyber 

Guardian only collects limited PII that is directly relevant and necessary to accomplish the 

specified purpose of tracking the production, dissemination, and disposition of threat reports 

shared under Section 4 of the Order and only retains PII for as long as necessary to fulfill this 

specified purpose. As a result, DHS only enters PII into the Cyber Guardian system that may 

allow U.S. private sector entities to better protect themselves against cyber threats and to 

facilitate proper coordination of victim notifications. 

Individual Participation: It is not possible to allow individual participation in the context of 

DHS’s sharing cyber threat information with the FBI’s Cyber Guardian system and it is not 

feasible for the Government to provide redress for individuals whose PII may be included in the 

information submitted to Cyber Guardian. 

As stated in the MOU, however, DHS understands that information submitted to Cyber Guardian 

is subject to applicable federal laws, including but not limited to the Privacy Act, the Freedom of 

Information Act, the Federal Records Act, and discovery requirements. To the extent 

information exchanged as a result of Cyber Guardian results in a request or demand for that (or 

related) information from FBI files pursuant to federal or state civil or criminal discovery or any 

other request by a third-party for FBI information, such disclosure may only be made after 

 

14 Available at www.dhs.gov/cybersecurity-and-privacy. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

15 | Page

consultation with, and approval by, the FBI and DHS (whose information is at issue), or as 

otherwise required by law. 

Purpose Specification: DHS components have a variety of authorities to collect and share cyber 

threat information, such as through their responsibilities to protect federal civilian networks, 

coordinate with the private sector, conduct law enforcement activities, analyze cyber threats, and 

perform mitigation assessments. As it relates to the MOU for DHS’s sharing of cyber threat 

information with the FBI’s Cyber Guardian system, the following authorities apply: 

1. Privacy Act of 1974, 5 U.S.C. § 552a;

2. Executive Order 13636, Improving Critical Infrastructure Cybersecurity, February 13, 

2013;

3. Presidential Policy Directive 21, Critical Infrastructure Security and Resilience, February 

12, 2013; and

4. Executive Order 12829, National Industrial Security Program, January 6, 1993, as 

amended.

Use Limitation: DHS only enters cyber threat reports into the Cyber Guardian system pursuant 

to Section 4(b) of Executive Order 13636 and the signed Cyber Guardian MOU with FBI. Both 

state that the information submitted to Cyber Guardian is to be used only for the purposes of 

tracking the production, dissemination, and disposition of threat reports shared under Section 4 

of the Order. In doing so, U.S. private sector entities may better protect and defend themselves 

against cyber threats and federal agencies may facilitate proper coordination of victim 

notifications.

Data Quality and Integrity: The cyber threat report information entered into the Cyber Guardian 

system by DHS, pursuant to Section 4(b) of Executive Order 13636, is derived from existing 

threat reporting. The data quality and integrity measures in place for those activities are set forth 

in the NCPS PIA.

Security: DHS accesses the Cyber Guardian application through the secure environment of the 

SIPRNET, a Department of Defense secret enclave. As explained in the MOU, the use of 

SIPRNET triggers certain reporting requirements in the event of an unauthorized disclosure. 

Furthermore, the FBI’s ROB for Cyber Guardian sets forth specific rules of behavior, expressly 

prohibited behavior, and monitoring/search provisions for users of the system.

Accountability and Auditing: As stated in the Cyber Guardian MOU, the FBI monitors, records, 

and audits use of Cyber Guardian to ensure compliance with applicable laws, regulations, 

policies, and with the terms of the MOU. If requested by the FBI, each agency that signed the 

MOU will be responsible for compiling system compliance-related information about its own 

authorized users and providing that information to the FBI. Such compliance-related 

information shall include tracking logons and logoffs, creating audit logs, and other appropriate 

measures, as related to DHS’s system. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

16 | Page

III. EO Section 4(c): Enhanced Cybersecurity Services 

To assist the owners and operators of critical infrastructure in protecting their systems 

from unauthorized access, exploitation, or harm, the Secretary, consistent with 6 U.S.C. 

143 and in collaboration with the Secretary of Defense, shall, within 120 days of the date 

of this order, establish procedures to expand the Enhanced Cybersecurity Services 

program to all critical infrastructure sectors. This voluntary information sharing 

program will provide classified cyber threat and technical information from the 

Government to eligible critical infrastructure companies or commercial service providers 

that offer security services to critical infrastructure.

Background 

DHS’s Enhanced Cybersecurity Services (ECS) was established as a voluntary information 

sharing program to assist critical infrastructure owners and operators to improve protection of 

their systems from unauthorized access, exploitation, or data exfiltration. ECS consists of the 

operational processes and security oversight required to share sensitive and classified cyber 

threat information with qualified commercial service providers15 and operational implementers16

(hereinafter “commercial service providers”) that will enable them to better protect their 

customers, which consist of U.S.-based public and private entities. 

DHS reported on the ECS Program in both the 2014 and 2015 Privacy and Civil Liberties 

Assessment Reports. In the 2014 Privacy and Civil Liberties Assessment Report, DHS focused

on discussing key foundational questions in the establishment and operation of the program and 

the Privacy Office conducted a FIPPs assessment of ECS. In the 2015 Report, DHS provided an 

overview of the privacy, civil rights, and civil liberties oversight of the program, the assessments 

of CRCL and the Privacy Office, and a summary of the PCR that the DHS Privacy Office 

conducted in coordination with the ECS Program and the NPPD Office of Privacy. This year’s 

report provides a brief update on the ECS program’s commercial service providers and also 

addresses the four recommendations from the April 15, 2015, DHS PCR of the ECS Program as 

discussed in last year’s privacy assessment.

ECS Program Update 

As explained in the 2015 Privacy and Civil Liberties Assessment Report, NPPD Office of 

Cybersecurity and Communications (CS&C) provides government furnished information (GFI), 

specifically indicators of malicious cyber activity,

17 to qualified commercial service providers. 

 

15 The term Commercial Service Provider (CSP), refers to a public or private company that is capable of providing 

managed security services for the protection of their customers, which consist of U.S.-based public and private 

entities. Any managed security service provider meeting the eligibility security requirements may become a CSP. 16 The term Operational Implementer refers to a critical infrastructure organization that may choose to build its own 

infrastructure for the purposes of receiving, managing, and utilizing the DHS cyber threat indicators in the 

protection of its information assets, in effect to act as its own commercial service provider. The requirements for 

operational implementers are the same as those for commercial service providers. For simplicity, references in this 

assessment to commercial service providers also apply to operational implementers.

17 Cyber threats can be defined as any identified efforts directed toward accessing, exfiltrating, manipulating, or 

impairing the integrity, confidentiality, security, or availability of data, an application, or a federal system, or 

information processed, controlled, stored on, or transmitting to/from an information system, without lawful 

authority. Information about cyber threats may be received from government, public, or private sources. Categories 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

17 | Page

Participating commercial service providers must enter into a memorandum of agreement with 

DHS and become accredited by achieving a high standard of security competence, including 

retaining the ability to safeguard sensitive information, obtaining personnel and facilities 

clearances, and constructing secure network systems as set forth by the security requirements of 

the ECS Program. 

As of the 2014 Assessment cycle, and as noted in the 2015 Privacy and Civil Liberties 

Assessment Report, only accredited commercial service providers are permitted to provide 

cybersecurity services to U.S.-based public and private entities. At the time that report was 

published, only AT&T and CenturyLink were accredited as commercial service providers for 

ECS. Since the 2015 report was published, however, Verizon and Lockheed Martin have also 

met the standards for accreditation and are now recognized as ECS Commercial Service 

Providers. During Fiscal Year 2015, the ECS Program also permitted commercial service 

providers to extend their ECS customer base beyond those determined to be within the sixteen 

critical infrastructure sectors, and ECS is now open to all U.S.-based public and private entities. 

Update on ECS Privacy Compliance Review Recommendations

As described in the 2015 Privacy and Civil Liberties Assessment Report, the DHS Privacy 

Office completed a PCR of the ECS Program18 in coordination with the ECS Program and the 

NPPD Office of Privacy. The PCR found that NPPD has demonstrated exemplary attention to 

implementing strong privacy protections in ECS and its related processes, and the DHS Privacy 

Office provided four recommendations for NPPD in order to further strengthen its privacy 

protections in ECS and its related processes. These recommendations as well as updates on how 

they have been addressed by NPPD are described below.

• Recommendation 1: NPPD should update the ECS PIA to better reflect the current state 

of indicator testing and the existing data quality protections DHS is using in the ECS 

Program.

Update: NPPD has published an ECS PIA Update to reflect the current state of indicator 

testing. The original PIA stated that ECS indicators were tested for false positives and 

false negatives in a test environment before sharing with the commercial service 

providers. The ECS PIA Update clarifies that while testing is a part of the signature 

development lifecycle as it relates to DHS’s deployment of signatures to the .gov domain; 

ECS shares indicators (GFI) with a CSP, not signatures. Indicators serve as the basis for 

an entity to develop a signature within its own unique environment. The CSP may choose 

to use GFI to develop signatures and would follow its own processes for testing. 

Consequently, because DHS is sharing indicators for ECS, not signatures, indicator 

testing is not performed. DHS has other measures to promote data quality including 

initial and periodic review of indicators which are governed by the program’s GFI Data 

Verification and Vetting Process to ensure GFI is timely, actionable, and vetted by DHS. 

 

of cyber threats may include, for example: phishing, IP spoofing, botnets, denials of service, distributed denials of 

service, man-in-the-middle attacks, or the insertion of other types of malware. 18 See “Privacy Compliance Review of the Enhanced Cybersecurity Services (ECS) Program,” available at 

www.dhs.gov/privacy
2016 EO 13636 Privacy & Civil Liberties Assessment Report

18 | Page

This process incorporates standard operating procedures that seek to minimize the use or 

collection of unnecessary PII. 

• Recommendation 2: NPPD should update the ECS PIA to reflect the current frequency 

of log reviews. 

Update: NPPD has published an ECS PIA Update to clarify that user activity in the 

National Cybersecurity Protection System, which maintains ECS-related data and 

information, is logged and the logs are reviewed regularly.

• Recommendation 3: NPPD should provide updated information about indicator 

retention in a future ECS PIA update.

Update: NPPD published the ECS PIA Update to explain that a records retention 

schedule for NCPS (Records Schedule # DAA-0563-2013-0008) was approved by 

NARA on January 12, 2015. The NCPS Records Retention Schedule is broken down by 

five broad capability areas and covers all fields and data collected by and maintained on 

NCPS, including the voluntary metric information for ECS. The NCPS retention 

schedule covers all cyber threat information and is not broken down by program. 

Generally, NPPD will destroy or delete cyber threat information when it is three years old 

or when it is no longer needed for agency business, whichever is later. Information that 

is inadvertently collected or determined not to be related to known or suspected cyber 

threats or vulnerabilities will be destroyed or deleted immediately or when it is no longer 

needed for agency business (e.g., after the completion of analysis). 

• Recommendation 4: NPPD should describe in a future ECS PIA update how its 

subsequent analysis of cybersecurity metrics may lead to the development of new 

indicators. 

Update: The updated ECS PIA explains that NPPD/CS&C provides cybersecurity 

indicators to commercial service providers, who participate in ECS information sharing, 

which in turn permits the providers to offer enhanced cybersecurity services to protect the 

networks of U.S.-based public and private sector entities that request them. The 

commercial service providers, at the request of ECS participants, use cyber indicators to 

block known or suspected cyber threats. As part of the program, commercial service 

providers may share summary information with NPPD/CS&C about the fact that known 

or suspected cyber threats were detected. This “fact of” occurrence reporting does not 

contain PII or information that could be considered PII19. As per the PCR 

recommendation, NPPD/CS&C is exploring subsequent analysis of data that may lead to 

the development of new indicators. 

 

19 DHS uses the phrase “information that could be considered PII” because certain indicators of a cyber threat can be 

the same type of information individuals use to identify themselves in online communications such as an email 

address or other information that might be included in the message or subject line. In the context of NCPS, these 

types of information are not used to identify an individual; instead, they are used as a reference point for particular 

known or suspected cyber threats.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

19 | Page

The DHS Privacy Office has determined the ECS updates explained above and memorialized in 

the DHS/NPPD PIA Update, DHS/NPPD/PIA-028(a), published on November 30, 2015 are 

responsive to the PCR recommendations and are considered closed-implemented. Furthermore, 

these updates do not affect the FIPPs assessment conducted for ECS in the 2014 Privacy and 

Civil Liberties Assessment Report. Should additional changes take place in the ECS Program 

that affect privacy, the DHS Privacy Office will assess the risks posed and the steps taken to 

mitigate them, and will include its assessment in a future Executive Order 13636 Privacy and 

Civil Liberties Assessment Report.

IV. EO Section 4(d): Private Sector Clearance Program for Critical Infrastructure

The Secretary, as the Executive Agent for the Classified National Security Information 

Program created under Executive Order 13549 of August 18, 2010 (Classified National 

Security Information Program for State, Local, Tribal, and Private Sector Entities), shall 

expedite the processing of security clearances to appropriate personnel employed by 

critical infrastructure owners and operators, prioritizing the critical infrastructure 

identified in section 9 of this order. 

As discussed in the 2014 Privacy and Civil Liberties Assessment Report, DHS built upon 

NPPD’s Critical Infrastructure Private Sector Clearance Program (since renamed to the Private 

Sector Clearance Program for Critical Infrastructure (PSCP)) to implement Section 4(d) of 

Executive Order 13636. Since that time, the PSCP has implemented minor enhancements to 

better meet the intent of Executive Order 13636 as described below. 

Clearance Prioritization Categories: In order to effectively meet the requirements outlined in 

Section 4(d) of the EO, as well as other critical needs for clearances, the Department developed 

three categories to prioritize private sector clearance applicants employed by the critical 

infrastructure owners and operators identified through Section 9 of the Executive Order. DHS 

assigns the applicant’s priority category during the initial application phase. The applicant’s 

priority category remains throughout the clearance package until DHS makes a clearance 

determination for the applicant. The three categories of prioritization are:

1. Normal Prioritization: This is the default categorization for clearance applications;

2. Time-Critical Prioritization: This is an accelerated process in which the application 

sponsor has certified a near-term threat requiring a security clearance and a pending 

classified threat briefing to share that information; and, 

3. Expedited Prioritization: This is the fastest option and applies to applications for 

personnel of critical infrastructure owners and operators, in which “a cybersecurity 

incident could reasonably result in catastrophic regional or national effects on public 

health or safety, economic security, or national security,” as identified in Section 9 of EO 

13636. 

Applications designated as Time-Critical or Expedited receive priority processing at each phase 

of the application process. 

Updated DHS Form 9014: With the enhancements to the PSCP, NPPD’s Office of 

Infrastructure Protection expanded the DHS Form 9014, Critical Infrastructure Private Sector 

Clearance Program Request, to collect additional information from qualified PSCP Nominees 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

20 | Page

who require clearances based on their day-to-day work related to the security and protection of 

critical infrastructure. As it relates to Executive Order 13636, these PSCP Nominees include, in 

part, the private sector clearance applicants employed by the critical infrastructure owners and 

operators identified through Section 9 of this Executive Order. As a result, PSCP Nominees 

must now provide the following information via the updated DHS Form 9014 (Note: (*) denotes 

a new data element requested on the updated DHS Form 9014):

• Full name;

• Company name and address;

• Business phone number;

• Business email address;

• Level of clearance requested;

• Current association memberships;

• U.S. Citizen (yes/no);

• Justification to access classified information (to include Nominee’s job title, position, 

and responsibilities);

• Information regarding whether the Nominee’s company Chief Security Officer (or the 

executive otherwise responsible for the Nominee organization’s security posture) has 

been notified of the Nominee’s nomination (yes/no/N/A);*

• Information regarding whether there is a secure facility within 50 miles where a 

clearance holder may attend a classified briefing (yes/no/no, but willing to travel);*

• Information pertaining to how the Nominee satisfies the criteria for PSCP nomination 

(checkboxes provide the criteria selection from EO 135497);* and,

• Nominee’s sector.

If the Nominee has held an active clearance within the past 24 months, then the Nominee 

must also provide:

• Whether he or she previously held or currently holds a clearance and what type of 

clearance he or she held or holds (Secret/Top Secret);

• The name of the Agency that sponsored the clearance;

• Contact information for his or her Security Official/Office (phone number and email 

address);

• Information regarding whether he or she is retired or separated or if he or she is 

planning on retiring and separating from the position in which he or she held an 

active clearance within the past 24 months (to include from where the Nominee is 

retiring or separating);

• If the Nominee is retired or separated, then he or she must also provide his or her date 

of retirement or separation;

• Reciprocity/reinstatement (yes/no (Nominees may only select “yes” if they have a 

current clearance or if their prior security clearance was active within the last 2 

years));* and,

• If a PSCP clearance holder is undergoing a reinvestigation, then he or she must 

provide information regarding how recently he or she used the PSCP clearance (No, 

Yes-within the past year, Yes-within the past 2 years, Yes-within the last 5 years, or 

Yes-within the last 10 years).*
2016 EO 13636 Privacy & Civil Liberties Assessment Report

21 | Page

These new data elements were added to improve the program’s overall effectiveness. For 

example, the PSCP is now requesting that Nominees provide information regarding whether or 

not they are located within 50 miles of a secure facility for classified briefings. This information 

will help the program determine the best way to deliver classified information to the PSCP 

Nominee if and when he or she is provided with a clearance. Furthermore, the updated DHS 

Form 9014 requests information from PSCP clearance holders undergoing reinvestigations 

regarding how often they have used their federal security clearance. This information will 

provide the PSCP with a better understanding of whether a clearance holder should continue to 

hold a federal security clearance in order to perform his or her duties.

The DHS Privacy Office determined that the changes do not alter the FIPPs assessment 

conducted for the PSCP in the 2014 Privacy and Civil Liberties Assessment Report. These 

changes were, however, captured in a DHS/NPPD Privacy Impact Assessment Update, 

DHS/NPPD/PIA-020(a) - Private Sector Clearance Program for Critical Infrastructure, which

was published on February 11, 2015. Should additional changes take place in the Program that 

affect privacy, the DHS Privacy Office will assess the risks posed and the steps taken to mitigate 

them, and will include its assessment in a future Executive Order 13636 Privacy and Civil 

Liberties Assessment Report.

V. Executive Order 13691, Promoting Private Sector Cybersecurity Information Sharing

Background

On February 13, 2015, President Obama signed Executive Order 13691, Promoting Private 

Sector Cybersecurity Information Sharing, to build upon the foundation established by Executive 

Order 13636 by encouraging the development of information sharing and analysis organizations 

(ISAO) to serve as focal points for cybersecurity information sharing and collaboration within 

the private sector and between the private sector and Government. Specifically, Executive Order 

13691: 

• Directs the Secretary of DHS to strongly encourage the development and formation of 

ISAOs;

• Directs DHS to select, through an open and competitive process, a non-governmental 

organization to serve as the ISAO Standards Organization. This ISAO Standards 

Organization will identify a set of voluntary standards or guidelines for the creation and 

functioning of ISAOs; 

• Streamlines the mechanism for DHS’s NCCIC to enter into information sharing 

agreements with ISAOs. This will ensure that robust, voluntary information sharing 

continues and expands between the public and private sectors; 

• Directs DHS to develop a more efficient means for granting clearances to private sector 

individuals who are members of an ISAO via a designated critical infrastructure 

protection program; and,

• Adds DHS to the list of federal agencies that approve classified information sharing 

arrangements.

The purpose of the ISAOs is to permit sharing of cyber threat information among a broader 

group of sharing and analysis organizations than is presently feasible. Current cyber threat 

information sharing among groups of this type is focused on Information Sharing and Analysis 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

22 | Page

Centers, which are linked to the 16 Critical Infrastructure Sectors and the corresponding SectorCoordinating Councils. The effort to suggest model information sharing structures to ISAOs 

responds to the independent establishment of voluntary participation cyber threat analysis and 

sharing organizations that are not tied to Critical Infrastructure Sectors. Expanding the scope of 

this information sharing – with appropriate privacy and civil liberties safeguards – will enable 

the Department to provide robust support to diverse groups that may be organized around 

regional cybersecurity interests, non-critical infrastructure industry or commerce interests, or 

other communities of interest seeking to voluntarily and collectively improve their cybersecurity 

posture. 

Executive Order 13691 Update 

Following the competitive process directed by Section 3(a) of the Order, the Department 

selected, as the ISAO Standards Organization, the University of Texas at San Antonio (UTSA) 

with support from Logistics Management Institute (LMI) and the Retail Cyber Intelligence 

Sharing Center (R-CISC). This ISAO Standards Organization will result in the promulgation of 

model practices standards for ISAOs, and, it is hoped, lead to the widespread establishment of 

ISAOs. ISAOs will serve as focal points for cybersecurity information sharing and collaboration 

within the private sector and between the private sector and government. Per Executive Order

13691, the UTSA team will work with existing information sharing organizations, owners and 

operators of critical infrastructure, relevant agencies, and other public and private sector 

stakeholders to identify a common set of voluntary standards or guidelines for the creation and 

functioning of ISAOs. 

DHS has participated in other activities in implementing Section 2(a) of the Executive Order. 

DHS led three public workshops with the private sector to receive feedback on some of the 

requirements that the selected ISAO Standards Organization should focus on upon selection. 

These workshops were held on the following dates and locations: 

• April 20, 2015 in San Francisco, CA (partnered with White House and 

PricewaterhouseCoopers); 

• June 9, 2015 in Cambridge, MA; and, 

• July 30, 2015 in San Jose, CA. 

DHS also provided over 25 briefings to private sector and Government organizations during that 

time frame to provide transparency into the process, discuss the development and formation of 

ISAOs, and encourage participation. 

Although the Department has undertaken significant activities to implement Executive Order 

13691, our offices determined that none of the activities directed by the Order are in a posture 

that is suitable for privacy or civil liberties assessment at this time. The DHS Privacy Office and 

CRCL will continue to monitor the progress of the Department’s Executive Order 13691 

activities and will assess these activities, as appropriate, in future Privacy and Civil Liberties

Assessment Reports.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

23 | Page

PART II: DEPARTMENT OF THE TREASURY
2016 EO 13636 Privacy & Civil Liberties Assessment Report

24 | Page

DEPARTMENT OF THE TREASURY

ASSESSMENT OF THE IMPLEMENTATION OF E.O. 13636, 

“IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY”

Introduction

On February 12, 2013, the President signed Executive Order (“EO” or “Order”) 13636, 

“Improving Critical Infrastructure Cybersecurity,” stating: “It is the policy of the United States to 

enhance the security and resilience of the Nation’s critical infrastructure and to maintain a cyberenvironment that encourages efficiency, innovation, and economic prosperity while promoting 

safety, security, business confidentiality, privacy, and civil liberties.” 

 

To ensure the inclusion of privacy and civil liberties protections in activities under the Order, 

Section 5(a) requires federal agencies to coordinate EO-related cybersecurity activities with their 

senior agency officials for privacy (“SAOP”). Section 5(b) further requires the SAOP to conduct 

an assessment of their agency’s activities under the Order and to submit to the Department of 

Homeland Security (“DHS”) its assessment for consideration and inclusion in a public report that 

shall be reviewed on an annual basis. 

The Department of the Treasury (“Treasury” or “Department”) is engaged in activities under the 

EO, and the Department’s SAOP submits the following assessment of Treasury’s activities 

conducted during the October 1, 2014 to September 30, 2015 reporting period. 

Treasury’s Privacy and Civil Liberties (PCL) Organization and Processes

Within Treasury, the Assistant Secretary for Management (“ASM”) is responsible for the overall 

implementation of privacy and civil liberties requirements. Treasury Order 102-25, “Delegation 

of Authority Concerning Privacy and Civil Liberties,” designates the ASM as the Department’s 

SAOP, Chief Privacy and Civil Liberties Officer, and Information Sharing Environment Privacy 

Official. 

At Treasury, the Deputy Assistant Secretary for Privacy, Transparency, and Records 

(“DASPTR”) is the ASM’s principal advisor on privacy and civil liberties matters. The 

DASPTR is responsible for establishing Treasury-wide policies, procedures, and standards to 

ensure the Department’s full compliance with federal laws, regulations, and policies relating to 

information privacy. 

Overview of 13636 Relevant Activities 

Fostering the stability of financial markets and institutions is an integral component of 

Treasury’s leadership, domestically and globally. A secure and resilient financial system is at 

the heart of our Nation’s economic prosperity and Treasury’s primary objective since 1789. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

25 | Page

In 1998, the President issued Presidential Decision Directive (“PDD”) 63, identifying 

telecommunications, banking and finance, energy, transportation, and essential government 

services as vulnerable sectors. In the PDD, the President appointed Treasury as the lead agency 

for liaison with the banking and finance sector as part of a national effort to assure the security of 

the United States’ increasingly vulnerable and interconnected infrastructures. In 1999, as part of 

this effort, Treasury supported the creation and development of the Financial Services 

Information Sharing and Analysis Center, which is one of the oldest private information-sharing 

Initiatives in the United States. 

Following the attacks of September 11, 2001, Treasury established the Office of Critical 

Infrastructure Protection and Compliance Policy (“OCIP”), chaired a newly formed Finance and 

Banking Information Infrastructure Committee comprised of financial regulators, and 

encouraged the establishment of the Financial Services Sector Coordinating Council of private 

sector institutions and organizations. 

Homeland Security Presidential Directive 7 (“HSPD 7”), released in 2003, superseded PDD 63 

and reaffirmed Treasury’s role as sector liaison by naming Treasury the Sector Specific Agency 

(“SSA”) for finance and banking, while recognizing the importance of the roles played by the 

Departments of Homeland Security, State, Justice, Commerce, and Defense in protecting our 

nation’s national infrastructure protection across all sectors. 

Presidential Policy Directive (“PPD”) 21, which superseded HSPD 7 in 2012, continued to 

advance a unified approach to strengthening and maintaining secure, functioning, and resilient 

critical infrastructure against both cyber and physical threats. PPD 21 identifies 16 critical 

sectors, reaffirming Treasury as SSA for the Financial Services Sector. 

In its capacity as the SSA for the Financial Services Sector, Treasury is the day-to-day federal 

interface and coordinating agency for various interagency and public-private partnership 

activities relating to the security and resilience of the Financial Services Sector’s critical 

infrastructure. These responsibilities generally are carried out through OCIP, which is part of the 

Treasury Office of Financial Institutions. OCIP facilitates implementation of EO 13636 as 

described below. 

Treasury’s Continued Activities under the EO for the Reporting Period 

Treasury’s activities under the EO have not materially changed since we last reported. Treasury 

continues to play a minor role in two programs that distribute personally identifiable information 

(PII): Information Sharing under section 4(a) of the EO, and the Critical Infrastructure Private 

Sector Clearance Program under section 4(d) of the EO. In addition, Treasury continues to play a 

minor role in identifying critical infrastructure where a cybersecurity incident could reasonably 

result in catastrophic consequences (“high risk critical infrastructure”), as required under section 

9(a) of the EO. 

As the SSA for the Financial Services Sector, Treasury continues to receive requests for 

nominations for national security clearances to allow financial services critical infrastructure 

owners, operators, and sector leaders to access cyber threat information. Through a consultative 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

26 | Page

process required by EO 13636, Treasury continues to assist law enforcement and national 

security agencies with identifying high risk critical infrastructure. 

During the FY 2015 reporting period, the Cyber Intelligence Group (CIG)20 of Treasury’s Office 

of Critical Infrastructure Protection and Compliance Policy (OCIP) held monthly classified cyber 

information meetings for cleared financial sector representatives, and, separately, for cleared 

financial regulators to increase the volume, timeliness, and quality of cyber threat information 

shared with the U.S. financial sector under Section 4 of EO 13636. This activity is consistent 

with our responsibilities under the EO that we assessed in previous reports. 

Summary of Assessment Methodology 

The Fair Information Practice Principles (“FIPPs”) are a set of internationally recognized 

principles designed to ensure the protection of information privacy protections. Treasury uses 

the FIPPs as the general framework to analyze Treasury’s collection, use, maintenance, and 

sharing of PII.

Detailed Analyses of Private Sector Clearance Program under 4(d) of EO 13636 

Section 4(d): Private Sector Clearance Program 

It is the policy of the United States Government to increase the volume, timeliness, and quality of 

cyber threat information shared with U.S. private sector entities so that these entities may better 

protect and defend themselves against cyber threats. . . .The [DHS] Secretary, as the Executive 

Agent for the Classified National Security Information Program created under Executive Order 

13549 of August 18, 2010 (Classified National Security Information Program for State, Local, 

Tribal, and Private Sector Entities), shall expedite the processing of security clearances to 

appropriate personnel employed by critical infrastructure owners and operators, prioritizing the 

critical infrastructure identified in section 9 of this order.

Detailed Description of Private Sector Clearance Program 

As the SSA for the Financial Services Sector, Treasury receives requests for access to cyber 

threat information from financial services critical infrastructure owners, operators, and sector 

leaders (i.e., Sector Coordinating Council members). Treasury recognizes that cyber threat 

information may include classified information and that an individual must have an active 

national security clearance prior to receiving classified information from the government. 

Therefore, to allow owners, operators, and sector leadership to receive classified cyber threat 

information, Treasury nominates appropriate individuals for national security clearances. 

In this program, Treasury receives requests for security clearances from DHS and the private 

sector. DHS is responsible for providing forms to Treasury for distribution and for referring 

 

20 The CIG consists of a specialized team of analysts with expertise in financial services, cybersecurity, and 

intelligence analysis. The CIG’s primary function is to distribute timely and actionable information and analysis that 

financial institutions can use to protect themselves from cyber attacks.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

27 | Page

individuals in the Financial Services Sector to Treasury for formal nomination. Private sector 

clearance candidates are required to complete certain sections of DHS Form 9014. Individuals 

from the Financial Services Sector submit a partially completed DHS Form 9014 to Treasury. A 

Treasury employee verifies that the private sector clearance candidate has completed the 

necessary sections of the form. The Treasury employee signs the form, nominating the 

individual for a security clearance, and sends the form to DHS as an attachment via encrypted 

electronic mail and deletes the form from Treasury systems. Once DHS receives the form, a 

DHS employee works directly with the nominee in the clearance process.

Description of Assessment Methodology

To facilitate the processing of national security clearances for appropriate Financial Services 

Sector personnel, Treasury participates in the DHS Critical Infrastructure Private Sector 

Clearance Program (“DHS Private Sector Clearance Program”). This program is a governmentwide service that provides a means for expediting the processing of national security clearance 

applications for private sector partners. Treasury is responsible for initiating the nomination 

process for Financial Services Sector security clearance nominees. Once nominated, DHS and 

the Office of Personnel Management (“OPM”) are responsible for conducting the investigation 

necessary to adjudicate national security clearances for nominated private sector individuals. 

The data collected for security clearances is not used for any purpose other than assisting with 

securing a clearance. A full assessment of the DHS Private Sector Clearance Program is 

included in the DHS portion of the 2015 Executive Order 13636 Privacy and Civil Liberties 

Assessments Report. 

Treasury uses the FIPPs to assess cybersecurity programs for potential privacy issues. The 

FIPPs are:

1. Transparency: Treasury should be transparent and provide notice to the public regarding 

its collection, use, sharing, and maintenance of PII. 

2. Individual Participation: Treasury should involve the individual in the process of using 

PII and, to the extent practicable, seek individual consent for the collection, use, sharing, 

and maintenance of PII. Treasury should also provide mechanisms for appropriate 

access, correction, and redress regarding Treasury’s use of PII. 

3. Purpose Specification: Treasury should specifically articulate the authority that permits 

the collection of PII and the purpose or purposes for which the PII is intended to be used. 

4. Data Minimization: Treasury should only collect PII that is directly relevant and 

necessary to accomplish the specified purpose(s) and only retain PII for as long as is 

necessary to fulfill the specified purpose(s). 

5. Use Limitation: Treasury should use PII solely for the purpose(s) specified in required 

information notices (e.g., systems of records notices). Sharing of PII outside the 

Department should be done in a manner compatible with the purpose for which the PII 

was originally collected. 

6. Data Quality and Integrity: Treasury should, to the extent practicable, ensure that PII is 

accurate, relevant, timely, and complete. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

28 | Page

7. Security: Treasury should protect PII (in all media) through appropriate security 

safeguards against risks such as loss, unauthorized access or use, destruction, 

modification, or unintended or inappropriate disclosure. 

8. Accountability and Auditing: Treasury should be accountable for complying with these 

principles, providing training to all employees and contractors who use PII, and auditing 

the actual use of PII to demonstrate compliance with these principles and all applicable 

privacy protection requirements. 

Civil liberties are those basic rights and freedoms guaranteed to individuals. As recognized by 

the EO and its associated guidance, these Constitutional rights may be implicated by 

cybersecurity programs that monitor lawful activities or communications. Therefore, in addition 

to its FIPPs analysis, Treasury will consider whether agency EO activities involve the monitoring 

or interception of communications, or compiling of information regarding lawful activities that 

may impact civil liberties. Treasury will also consider the legal authorities that support such 

activities and the procedures undertaken to safeguard individual rights in carrying out such 

activities.

Privacy and Civil Liberties (PCL) Assessment of Private Sector Clearance Program 

PCL Protections and Compliance 

All PII collected within this activity is stored on a Treasury system. Permission to access this 

information is granted on a need to know basis to protect the information collected. Information 

is stored within the Treasury network on a temporary basis only. Treasury acts as a facilitator in 

this process, so the PII submitted for clearance purposes is not shared with or used by any other 

Treasury programs. The majority of this activity is performed by DHS. Therefore, that 

Department handles the majority of the PCL protections and compliance associated with it. 

Protections Response

Are individuals provided 

notice at the time of 

collection regarding why the 

information is being collected 

and how it will be used?

Treasury uses DHS Form 9014, “Critical Infrastructure 

Private Sector Clearance Program Request,” to collect the 

limited set of PII necessary to nominate an individual for a 

national security clearance. A Privacy Act statement is 

provided to individuals at the time they receive the form 

advising them of why the information is being collected and 

how it will be used.

Please describe how the 

program removes data that 

is no longer necessary 

Individuals identified by their organization or by DHS 

electronically mail Treasury a partially completed DHS 

Form 9014. Once received, Treasury reviews the 

information and nominates the individual by forwarding the 

form to DHS. While in Treasury’s custody, the DHS Form 

9014 is a working paper. Once DHS receives it, DHS is 

responsible for maintaining and disposing the form under 

General Records Schedule 18, Number 22, Personnel 

Security Clearance Files. Once DHS confirms the receipt of 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

29 | Page

Protections Response

DHS Form 9014, any copies of such form maintained at 

Treasury are working papers. As working papers in a DHS 

system of records, Treasury is no longer responsible for 

maintaining them. Once Treasury receives confirmation 

from DHS that it received the form, Treasury deletes the 

partially completed DHS Form 9014 from its system.

Please describe any steps 

taken to mitigate any use of 

PII that is not specified in the 

applicable notices.

Once received, Treasury reviews all DHS Form 9014s. 

Treasury employees complete two steps: first, they review 

information only to ensure that the proper boxes have been 

filled in and then they formally nominate the individual by 

electronically mailing the DHS Form 9014 to DHS. While 

Treasury reviews the form for completeness, it is stored in a 

local folder, with access limited to only those who have a 

need to know the information to perform their duties. 

Please describe any 

safeguards that are in place

to ensure the continued 

security of data maintained 

within the system.

Information Treasury collects in support of the DHS Private 

Sector Clearance Program is sent directly from the private 

sector clearance candidate to Treasury by electronic mail. 

AES 256 bit Encryption is deployed by the Treasury 

Network for encrypting external traffic from the 

Departmental Offices Local Area Network (“DO LAN”). 

DO LAN employs technology that scans for viruses, 

malware, spam, and other dangerous or suspicious signatures 

before being delivered to mailboxes. Anything identified as 

potentially harmful to PII being sent to Treasury employees 

is quarantined in a secure container until it can be handled 

properly. While Treasury reviews the DHS Form 9014 for 

completeness, it is stored in a Treasury local shared drive 

folder with restricted access. Treasury’s non-classified 

electronic mail and local shared drives are maintained on the 

DO LAN. The DO LAN is rated as a Federal Information 

Security Management Act HIGH system, meaning that the 

loss of confidentiality, integrity, or availability could be 

expected to have a severe or catastrophic adverse effect on 

organizational operations, organizational assets, or 

individuals. The safeguards applied to the DO LAN reflect 

the sensitivity of the information it contains.

Please describe the method 

for securing data at rest in 

the system. 

Treasury employs Microsoft Active Directory’s role based 

access controls to prevent unauthorized access to data at rest 

on the DO LAN. This directory helps ensure that employees 

and contractors who do not have a need to access the 

information stored in this program do not have privileges to 

access the information.

What methods are in place to 

audit access to records 

Treasury deploys a Splunk Enterprise solution to allow for 

auditing of user activities on the DO LAN. The solution 

monitors role based access controls assigned to the files and 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

30 | Page

Protections Response

maintained within the 

system?

folders in which Treasury temporarily stores DHS Form 

9014s. This helps Treasury prevent employees who have 

access to the information to perform their official Treasury 

functions from exceeding their authority by accessing and/or 

using the information for unauthorized purposes.

Please describe any agency 

oversight mechanisms that 

apply to the system. 

Private sector clearance candidates send their information in 

support of the DHS Clearance Program to Treasury by 

electronic mail. While Treasury reviews the DHS Form 

9014 for completeness, it is stored in a local shared drive 

folder. Treasury’s non-classified electronic mail and shared 

drives are maintained on the DO LAN, a system secured at 

the highest level for a non-classified system. There is no 

way to guarantee that electronic mail sent to Treasury from 

outside entities is encrypted. 

All Treasury information systems used to process and store 

PII undergo a mandatory security assessment and 

authorization (“SA&A”) process to verify that the system 

provides adequate measures to preserve the confidentiality, 

integrity, and availability of all sensitive information 

residing on or transiting those systems. A Privacy Impact 

Assessment (“PIA”) is required as part of the SA&A 

process. The PIA for the DO LAN was completed on Dec 4, 

2007. A revised and updated Privacy and Civil Liberties 

Impact Assessment (“PCLIA”) for the DO LAN is currently 

in development. 

PIAs or Other Documentation 

DHS Form 9014s are stored only on the DO LAN while they are reviewed for completeness. The

PIA for the DO LAN was completed on Dec 4, 2007 and is currently being updated. A PIA is 

not required when information contained in a system relates to internal government operations or 

when it has been previously assessed under an evaluation similar to a PIA. 

FIPPS and/or Civil Liberties Analysis:

Transparency: Response:

How is the general public 

informed about the DHS 

Critical Infrastructure 

Private Sector Clearance 

Program? 

DHS is the lead agency for the DHS Private Sector 

Clearance Program. Pursuant to the E-Government Act of 

2002 and Office of Management and Budget (OMB)

Memorandum 03-22, “OMB Guidance for Implementing 

the Privacy Provisions of the E-Government Act of 2002,” 

DHS last published a PIA for the program on February 11, 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

31 | Page

2015. . The PIA, which informs the general public about 

this program, is available to the general public on the DHS 

Privacy Office’s website.21

When collecting information 

from members of the public, 

does the program submit 

documentation for an OMB 

Collection number?

Yes. The collection number for DHS Form 9014 is OMB 

No. 1670-0013. DHS last published notice of the form in 

the Federal Register on September 24, 2014. See Federal 

Register Docket Number DHS-2014-0007.

Does the agency operate a 

Privacy Act system of records 

in support of the DHS Critical 

Infrastructure Sector 

Clearance Program?

Treasury does not operate a Privacy Act system of records 

in support of the DHS Sector Clearance Program. Once 

Treasury transmits the DHS Form 9014 to DHS, the system 

of records notice entitled DHS/ALL–023 Department of 

Homeland Security Personnel Security Management, 75 FR 

8088 (February 23, 2010) covers the information.

How does this program 

ensure that notices are 

updated to reflect system or 

program changes?

As the lead agency for the DHS Private Sector Clearance 

Program, DHS is responsible for ensuring that its PIA is 

updated to reflect system or program changes. This report 

also serves to provide notice to the public about the privacy 

safeguards deployed in the implementation of the DHS 

Private Sector Clearance Program. Treasury does not 

maintain any additional notices with respect to its 

supporting role in the DHS Private Sector Clearance 

Program. A PIA is not required when information 

contained in a system relates to internal government 

operations; when it has been previously assessed under an 

evaluation similar to a PIA.

Individual Participation: Response:

Are individuals asked for 

consent and given the 

opportunity to object to the 

collection of their PII? 

Yes. Individuals in the Financial Services Sector who have 

been identified by their organization or by DHS as needing 

access to classified cyber threat information may complete 

DHS Form 9014 and securely transmit it by electronic mail 

to Treasury to start the nomination process. There is a 

Privacy Act Statement in the form providing notice to 

individuals regarding DHS’s use of the information. 

Participation in the DHS Private Sector Clearance Program 

is voluntary. Individuals who do not approve of DHS’s use 

of the information as stated in DHS Form 9014 have the 

opportunity to object to collection of their PII by not 

completing and submitting the form for review. By 

completing and submitting the form, the individuals consent 

to the collection of the contents of the form. The individual 

is not required to submit information for a clearance, but 

 21 The DHS PIA for the Private Sector Clearance Program is available here: 

https://www.dhs.gov/sites/default/files/publications/privacy-pia-nppd-pscp-february2015.pdf
2016 EO 13636 Privacy & Civil Liberties Assessment Report

32 | Page

refusal to submit the information will result in their inability 

to secure a clearance.

Are individuals given the 

opportunity to access and 

correct their PII?

Yes, nominees have the opportunity to access and correct 

information submitted using the DHS Form 9014. Access 

and correction procedures are described in the DHS Critical 

Infrastructure Private Sector Clearance Program PIA, which 

is available to the public through the DHS Privacy Office 

website. A PIA is not required when information contained 

in a system relates to internal government operations; when 

it has been previously assessed under an evaluation similar 

to a PIA.

Describe the mechanism 

provided for an individual to 

seek redress in the event of 

inappropriate access to or 

disclosure of their PII.

If inappropriate access or disclosure gave rise to sufficient 

risk to the individual or Treasury, Treasury would provide 

notification to the individual as required in Treasury 

Directive (TD), 25-08, Safeguarding Against and 

Responding to the Breach of PII. If notification is given 

under TD 25-08, the notice would provide a point of contact 

to whom questions may be directed. If questions evolve into 

a complaint, the complaint will be addressed by the Office of 

Privacy, Transparency, and Records working in conjunction 

with the Office of General Counsel and the Office of Public 

Affairs.

Purpose Specification: Response:

Please provide the specific 

purpose(s) for the 

maintenance of PII within 

the system

Treasury collects PII from individuals in the Financial 

Services Sector who their organization or DHS has identified 

as needing access to classified cyber threat information. 

After DHS or sector representatives identify individuals who 

need a clearance, the private sector clearance candidate 

completes the form and sends it to Treasury. Treasury 

disposes of the information after it ensures the DHS Form 

9014 is completed according to the form’s directions, 

securely transmits the completed form to DHS, and receives 

notice of receipt from DHS.

What steps are taken to 

ensure the authority for the 

collection is valid?

Pursuant to PDD 21, “Critical Infrastructure Security and 

Resilience,” Treasury is the SSA for the Financial Services 

Sector. In this role, and in support of the EO, Treasury may 

nominate individuals from the sector for national security 

clearances. Treasury is responsible for verifying that 

individuals in the process are associated with the Financial 

Services Sector.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

33 | Page

Data Minimization: Response:

Please describe the data 

elements that are relevant 

and necessary.

To initiate the process, individuals complete the DHS Form 

9014 and send the following information to Treasury: name, 

company name/address, phone number, e-mail address, level 

of clearance, and citizenship. Treasury then securely 

transmits this information to DHS after reviewing it for 

completeness.

Employees of the Office of Privacy, Transparency, and 

Records have conducted several meetings with OCIP to 

ensure that any PII distributed has been minimized and is 

only used for its original stated purpose. As the SSA for the 

Financial Services Sector, it has been determined that 

Treasury’s knowledge of the Financial Services Sector is 

instrumental in the decision making process for identifying 

individuals within the sector who require clearances.

Use Limitation: Response:

Please describe the steps 

taken to ensure the use of PII 

is limited to the purpose(s) 

specified in applicable

notices.

PII that Treasury receives for the DHS Critical Infrastructure 

Private Sector Clearance Program is limited to the 

information submitted by the nominee using DHS Form 

9014. Once identified, Treasury directs private sector 

clearance candidates to submit the DHS Form 9014 to a 

secure Treasury electronic mail inbox that is dedicated to 

receipt of these forms. Access to the dedicated inbox is 

limited to Treasury employees and contractors who have a 

need to know. Treasury does not share DHS Form 9014s 

with any other Treasury bureaus or offices and only shares 

them externally with DHS. Information collected in this 

program is only used for its original purpose.

Data Quality and Integrity: Response:

What steps are taken to 

ensure the continued quality 

and integrity of data 

maintained by the project or 

system?

Information Treasury collects in support of the DHS Critical 

Infrastructure Private Sector Program is sent directly from 

the potential nominee to Treasury by electronic mail. 

Treasury, in turn, sends the information on to DHS using 

encrypted electronic mail. DHS then contacts the nominee 

directly to provide the additional information necessary to 

complete the remaining DHS Form 9014 fields. 

What steps are taken to 

ensure information 

maintained in the system is 

accurate, timely, relevant, 

and complete?

After DHS receives the DHS Form 9014 from Treasury and 

collects additional information from the private sector 

nominee/clearance candidate to complete the form, DHS 

provides to OPM the information necessary to begin the 

background investigation. OPM then works directly with 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

34 | Page

nominees to ensure that the information provided to Treasury 

and DHS is accurate, timely, and complete. Nominees are 

provided the opportunity to correct inaccurate or erroneous 

information. Any inaccurate or outdated information 

provided to Treasury is thereby corrected by either DHS or 

OPM.

Please describe the method 

for eliminating PII that is no 

longer needed.

Information collected by Treasury in support of the DHS

Private Sector Clearance Program is sent directly from the 

potential nominee to Treasury by electronic mail. While the 

DHS Form 9014 is being reviewed by Treasury, the form is 

stored in a Treasury local shared drive folder with access 

limited to personnel and contractors who have a need to 

know. After Treasury electronically mails the partially 

completed form to DHS and receives confirmation from 

DHS that it received the form, Treasury deletes the partially 

completed DHS Form 9014.

Security: Response:

Please describe any 

safeguards that are in place 

to ensure the continued 

security of data maintained 

within the system.

Information collected by Treasury in support of the DHS 

Private Sector Program is sent directly from the potential 

nominee to Treasury by electronic mail. While the DHS 

Form 9014 is being reviewed by Treasury, it is stored in a 

Treasury local shared drive folder with access limited to 

personnel and contractors who have a need to know. 

Treasury’s non-classified electronic mail and local shared 

drives are maintained on the DO LAN. The safeguards 

applied to the DO LAN reflect the sensitivity of the 

information it contains.

Please describe the method 

for securing data at rest in 

the system. 

Treasury employs Microsoft Active Directory’s role based 

access controls and audit controls to prevent unauthorized 

access to or use of data at rest on the DO LAN.

If data from the system is 

sent electronically, what 

methods are in place to 

ensure appropriate 

safeguards apply? 

Private sector clearance candidates send the partially 

completed DHS Form 9014 to a secure Treasury electronic 

mail inbox dedicated to receiving these forms. Treasury then 

reviews the form for completeness and forwards it via 

encrypted electronic mail to DHS. AES 256 bit Encryption 

is deployed by Treasury Network for encrypting external 

traffic from the DO LAN. 

Accountability and 

Auditing:

Response:

What methods are in place to 

audit access to records 

Treasury deploys a Splunk Enterprise solution to audit user 

activities on the DO LAN. The solution monitors role based 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

35 | Page

maintained within the 

system?

access controls assigned to files and folders in which 

Treasury temporarily stores DHS Form 9014s.

Please describe any agency 

oversight mechanisms that 

apply to the system. 

All Treasury information systems used to process and store 

PII undergo a mandatory SA&A process to verify that the 

system provides adequate measures to preserve the 

confidentiality, integrity, and availability of all sensitive 

information residing on or transiting those systems. 

Treasury information security professionals oversee 

completion of the SA&A process. A PIA is required as part 

of the SA&A process.

Treasury also deploys a Splunk Enterprise solution to audit 

user activities on the DO LAN. The solution monitors role 

based access controls assigned to files and folders in which 

Treasury temporarily stores DHS Form 9014s. 

The PIA for the DO LAN was completed on Dec 4, 2007. A 

revised and updated PCLIA for the DO LAN is currently in 

development. A PIA is not required when information 

contained in a system relates to internal government 

operations or when it has been previously assessed under an 

evaluation similar to a PIA.

Civil Liberties Considerations:

The Office of Privacy, Transparency, and Records reviewed this activity, its standards, 

and the criteria for participation in it. At this time, there is no Privacy and Civil 

Liberties Impact Assessment for DO LAN that specifically addresses the information in

this program. Treasury is currently working on an updated Privacy and Civil Liberties 

Impact Assessment for the DO LAN that will address the privacy and civil liberties 

information in this program.

 

PCL risks/impacts: 

Risk: Impact:

Please explain the possibility 

of redress if data is lost due 

to an email breach. 

If inappropriate access or disclosure gave rise to sufficient 

risk to the individual or Treasury, Treasury would provide 

notification to the individual as required in TD 25-08, 

Safeguarding Against and Responding to the Breach of PII. 

If notification is given under TD 25-08, a relevant point of 

contact would be given, to whom questions may be directed. 

If questions evolve into a complaint, the complaint will be 

addressed by the Office of Privacy, Transparency, and 

Records.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

36 | Page

Please describe the method 

for ensuring that access to 

data maintained within the 

system is limited to 

individuals with a need to 

know. 

Identity verification for access to information maintained on 

the DO LAN includes the use of personal identity 

verification cards, usernames, and passwords. 

Private Sector Clearance Program Summary 

Treasury has conducted its review for the reporting period and has determined that the limited 

role the Department plays in the Private Sector Clearance Program raises no broader PCL issues, 

policy considerations, nor legal considerations. Treasury will continue to evaluate its role in the 

program and may develop a more thorough privacy assessment, as that role expands or changes 

for future reports. 

Detailed Analyses of Cyber Security Information Sharing Under 4(a) of EO 13636 

Section 4(a): Cyber Security Information Sharing22 

It is the policy of the United States Government to increase the volume, timeliness, and quality 

of cyber threat information shared with U.S. private sector entities so that they may better 

protect and defend themselves against cyber threats.

Detailed Description of Cyber Security Information Sharing 

To increase the volume, timeliness, and quality of cyber threat information shared with U.S. 

financial sector entities so they may better protect and defend themselves against cyber threats, 

Treasury requests declassification of and subsequently disseminates relevant law enforcement 

and intelligence information to the financial sector (including financial regulators) and other 

critical infrastructure partners. This information consists of malicious cyber actors’ tactics, 

techniques, procedures (TTPs) and associated indicators, to assist in network defense capabilities 

and planning. In addition, Treasury occasionally receives information on malicious cyber 

actors’ TTPs and associated indicators from the financial sector and continued to do so during 

the current reporting period. 

 

22 Treasury’s cyber security information sharing initiatives to provide certain cybersecurity threat information to the 

financial services sector are, pursuant to Presidential Policy Directive (PPD) 21, which preceded the EO. In PPD-21, 

the President outlined the national effort to strengthen and maintain secure, functioning, and resilient critical 

infrastructure, which provides the essential services that underpin American society. PPD-21 designated the financial 

services sector as a critical infrastructure sector and designated Treasury as the SSA for the financial services sector. 

Treasury, in coordination with the Department of Homeland Security and other relevant federal departments and 

agencies, is responsible for providing, supporting, and facilitating technical assistance for this sector to identify 

vulnerabilities and help mitigate incidents, as appropriate. However, these activities are within the scope of the EO, 

therefore, it is included as part of this report. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

37 | Page

OCIP shares cyber threat information in the form of unclassified Cyber Intelligence Group 

(CIG)23 Circulars, through monthly meetings, and upon request from the financial services sector 

or a member of the sector. These activities are described in more detail below: 

CIG Circulars and Financial Services Sector Requests 

OCIP’s CIG Circulars are intended to increase the volume, timeliness and quality of cyber threat 

information shared with the U.S. financial services sector so that sector entities may better 

protect and defend themselves against cyber threats. Pursuant to EO 13636 and the instructions 

issued by the Attorney General, the Secretary of Homeland Security, and the Director of 

National Intelligence, the U.S. Government produces timely unclassified reports of cyber threats 

to the U.S. homeland. In addition to these unclassified reports, the financial services sector seeks 

relevant information from OCIP regarding cyber threats to the financial services sector.

Specifically, OCIP receives requests for cyber threat information targeting the financial services 

sector through the Financial Services Information and Analysis Center (FS-ISAC). The FSISAC was established in 1999 pursuant to PDD 63, as an information sharing mechanism to 

gather, analyze, “sanitize,” and disseminate information between the U.S. Government and the 

private sector. The FS-ISAC allows the U.S. Government to convey information to the private 

sector that will allow financial services firms to better protect their computer systems from 

attack. 

The FS-ISAC makes periodic requests to Treasury for cyber threat information targeting 

financial sector firms that is not otherwise available to the financial sector. These requests may 

themselves contain cyber threat information the FS-ISAC received from private financial 

services sector firms, including malicious cyber actors’ tactics, techniques, and procedures 

(TTPs) and associated indicators. As discussed above, the FS-ISAC serves as a mechanism to 

appropriately sanitize24 information shared with the U.S. Government by the private sector. 

In response to these requests, OCIP gathers declassified cyber threat information from U.S. 

Government sources, primarily intelligence and law enforcement agencies, to describe cyber 

threats to the financial services sector. OCIP uses this information to draft unclassified CIG 

Circulars for the purpose of sharing this cyber threat information with financial services sector 

entities and other critical infrastructure partners through the FS-ISAC. The information obtained 

by OCIP is lawfully collected by other U.S. Government agencies and only includes information 

approved for release by the U.S. Government data owner or owners to the FS-ISAC, for network 

defense purposes. OCIP does not solicit information from the private sector for inclusion in the 

 

23 The CIG consists of a specialized team of analysts with expertise in financial services, cybersecurity, and 

intelligence analysis. The CIG’s primary function is to distribute timely and actionable information and analysis that 

financial institutions can use to protect themselves from cyber attacks.

24 The term "sanitization," includes (but is not limited to) distilling the information so it is not traceable to the 

submitter and does not reveal any information that:

• Is proprietary, business-sensitive, or a trade secret;

• Relates specifically to the submitting person or entity (explicitly or implicitly); or

• Is otherwise not customarily in the public domain.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

38 | Page

CIG Circulars. In one instance during the FY 2015 reporting period, Treasury included 

information supplied by a private sector entity through FS-ISAC in a produced CIG Circular. 

OCIP shares cyber threat information in the form of unclassified CIG Circulars, and upon 

request from the financial services sector or a member of the sector. CIG Circulars provide 

information on advanced persistent cyber threat actors’ tactics, techniques and procedures and 

associated indicators. CIG Circulars are provided to financial institutions, their supporting cyber 

security service providers, financial regulators, DHS’s Cyber Information Sharing and 

Collaboration Program, and other critical infrastructure partners, for the purpose of protecting 

U.S. critical infrastructure from cyber threats.

Monthly Classified Cyber Information Meetings 

To increase the volume, timeliness, and quality of cyber threat information shared with U.S. 

financial sector entities, in FY 2015, Treasury’s Financial Sector Cyber Intelligence Group (CIG) 

began holding monthly classified cyber information meetings for cleared financial sector 

representatives and, separately, for cleared financial regulators. The meeting participants have to 

provide the following PII to enter the Treasury building: legal name, date of birth, social 

security number, and nationality. This information is also needed to verify that the participants 

have active security clearances. Instead of providing their PII each month, Treasury gave the 

meeting participants the option of authorizing the CIG, in writing, to retain their PII to facilitate 

building access and clearance verification for CIG-sponsored meetings in 2015. With their 

permission, their PII is stored in a locked cabinet in a Sensitive Compartmented Information 

Facility (SCIF) in a folder marked Privacy Protected Data. In particular, the CIG retains the PII 

for 11 cleared financial sector representatives, 19 cleared financial regulators, and six FBI and 

DHS personnel to facilitate their participation in the meetings. The participants have the option 

of authorizing the CIG to retain their PII to facilitate building access and clearance verification 

for CIG-sponsored meetings in 2016. If they choose to not authorize the CIG to retain their PII 

in 2016, their PII will be destroyed. 

Cyber Security Information Sharing PCL Assessment

PIAs or Other Documentation 

Information in this program is disseminated through correspondence and uploaded onto two 

portals: the Financial Services Information Sharing and Analysis Center (FS-ISAC) portal, and 

the DHS HSIN Financial Services portal, which is maintained by Treasury. Treasury’s nonclassified electronic correspondence and shared drives are maintained on the DO LAN. All 

Treasury information systems used to process and store PII undergo a mandatory SA&A process 

to verify that the system provides adequate measures to preserve the confidentiality, integrity, 

and availability of all sensitive information residing on or transiting those systems. A PIA is not 

required when information contained in a system relates to internal government operations or 

when it has been previously assessed under an evaluation similar to a PIA. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

39 | Page

Standard for Sharing PII 

OMB Memorandum 07-16 defines personally identifiable information (PII) as information 

“which can be used to distinguish or trace an individual’s identity, such as their name, social 

security number, biometric records, etc., alone, or when combined with other personal or 

identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother’s maiden name, etc.” 

OCIP only intends to produce technical descriptions of malware in its CIG Circulars. The CIG 

Circulars produced for the FS-ISAC in FY 2015 described cyber threats to the financial services 

sector, including technical information that would help a network systems administrator identify 

a particular form of malware rather than an individual. They did not include any individual’s 

name, Social Security number, biometrics, or e-mail address. Some of the technical descriptors 

included in the CIG Circulars may include TTPs, file names, domain names, and Internet

Protocol (IP) addresses to which malware beacons direct, or hashes that characterize particular 

forms of malware. In some cases, these technical descriptions could be PII under OMB’s broad 

definition because they potentially could link back to an individual. IP addresses, for example, 

sometimes could be traced back to entities, groups of individuals sharing an IP address, or a 

specific individual. OCIP, however, does not “link” an IP address or other technical description 

back to a particular entity, group, or individual, even if it were possible to do so in certain cases. 

OCIP only uses the technical descriptions to alert the financial services sector to a characteristic 

of a particular piece of malware, not to identify a specific individual or entity. 

Although any PII associated with technical descriptions in CIG Circulars is de minimis, Treasury 

nevertheless analyzed the contents of the circulars to assess compliance with the FIPPs. OCIP 

includes technical descriptions in its CIG Circulars when they are relevant and necessary to 

describe a cyber threat to the financial services sector. CIG Circulars report information that is 

actionable, relevant, timely, and not available elsewhere to the financial sector. When 

responding to specific requests for information from the FS-ISAC, OCIP only requests lawfully 

obtained information from U.S. Government intelligence community and law enforcement 

agencies to address the request. All information included in CIG Circulars is declassified and 

approved for release to the FS-ISAC by the data owner or owners. 

The CIG Circulars are produced for the FS-ISAC pursuant to the Traffic Light Protocol (TLP) 

initially established by DHS and adopted with modifications by the FS-ISAC. Most of the CIG 

Circulars are identified as TLP Green, which permits sharing among peers, trusted government 

and critical infrastructure partners, and service providers, but not via publicly accessible 

channels. FS-ISAC explains the TLP to its members. FS-ISAC distributes the Circulars to 

critical infrastructure owners in other sectors through the National Council of ISACs and also to 

members of the DHS Homeland Security Information Network (HSIN) Financial Services Portal. 

Treasury shares the information obtained through its cyber security activities for cybersecurity 

purposes only.

 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

40 | Page

FIPPS and Civil Liberties Analysis:

Transparency: Response:

How is the general public 

informed about this 

program? 

The general public is informed of this program through PDD 

21 and through this report. 

Does the agency operate a 

Privacy Act system of 

records in support of this 

program?

The information sharing process does not require a system of 

records notice because PII is not collected by Treasury 

directly, but relies upon Intelligence and Law Enforcement 

agencies to collect and identify cyber threat information. 

Treasury then requests from the collecting agency the 

permission to disseminate that cyber threat information to 

the financial sector. Potential cyber security threats, as well 

as technical indicators and tactics, techniques, and 

procedures of known cyber threats are distributed in this 

program to prevent cybersecurity attacks on the financial 

services sector.

Individual Participation: Response:

Are individuals asked for 

consent and given the 

opportunity to object to the 

collection of their PII? 

Treasury is not responsible for the collection of PII in this 

program and therefore is not required to ask for consent. 

The CIG Circulars produced to the FS-ISAC in FY 2015 

described cyber threats to the financial services sector, 

including technical information that would help a network 

systems administrator identify a particular form of malware 

rather than an individual. In some cases, these technical 

descriptions could be PII under OMB’s broad definition, 

because they potentially could link back to an individual. 

However, Treasury does not “link” the technical descriptions 

back to a particular entity, group, or individual, even if it 

were possible to do so in certain cases. Therefore, it would 

be impossible for Treasury to obtain consent from 

individuals who may be linked to the technical information 

included in CIG Circulars, and in the monthly meetings. 

Are individuals given the 

opportunity to access and 

correct their PII?

The information is related to cyber threats, not individuals, 

and is collected by intelligence agencies and law 

enforcement, who have their own processes and procedures 

for handling and correcting PII. 

Describe the mechanism 

provided for an individual to 

seek redress in the event of 

inappropriate access to or 

disclosure of their PII.

If inappropriate access or disclosure gave rise to sufficient 

risk to the individual or Treasury, Treasury would provide 

notification to the individual as required in TD 25-08, 

Safeguarding Against and Responding to the Breach of PII. 

If notification is given under TD 25-08, a relevant point of 

contact would be given, to whom questions may be directed. 

If questions evolve into a complaint, the complaint will be 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

41 | Page

addressed by the Office of Privacy, Transparency, and 

Records.

Purpose Specification: Response:

Please provide the specific 

purpose(s) for the 

maintenance of PII within 

the system

Intelligence and law enforcement agencies gather 

information regarding cyber threat information, which may 

contain limited PII in the form of IP addresses. As part of its 

information sharing activities under PPD 21 and Section 4 of 

EO 131636, Treasury expressly requests declassification of 

cyber threat information for dissemination to the Financial 

Services Sector to assist with network defense.

Data Minimization: Response:

Please describe the data 

elements that are relevant 

and necessary.

Treasury does not collect information directly, but relies 

upon Intelligence and Law Enforcement agencies to collect 

and report cyber threat information. Treasury then requests 

from the collecting agency the permission to disseminate that 

cyber threat information to the financial sector. Potential 

cyber security threats, as well as technical indicators and 

tactics, techniques, and procedures of known cyber threats 

are distributed in this program to prevent cybersecurity 

attacks on the financial services sector. 

The CIG Circulars produced for the FS-ISAC in FY 2015 

described cyber threats to the financial services sector, 

including technical information that would help a network 

systems administrator identify a particular form of malware 

rather than an individual. They did not include any 

individual’s name, Social Security number, biometrics, or email address. Some of the technical descriptors included in 

the CIG Circulars may include TTPs, file names, domain 

names, and IP addresses to which malware beacons direct, or 

hashes that characterize particular forms of malware. 

OCIP along with Treasury’s Office of Privacy Transparency 

and Records has determined that the de minimis PII that may 

be linked to the TTPs, file names, domain names, IP 

addresses to which malware beacons direct, or hashes from 

CIG Circulars are relevant and necessary to describe a cyber 

threat to the financial services sector. 

CIG Circulars report information that is actionable, relevant, 

timely, and not available elsewhere to the financial sector.

How long does Treasury 

retain the information 

contained in CIG Circulars? 

Treasury does not limit recipients’ retention of the 

information contained in CIG Circulars. OCIP presently 

keeps copies of all its Circulars for reference purposes; the 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

42 | Page

oldest CIG Circular derived from law enforcement reporting 

was issued on December 2, 2013. Treasury will continue to 

evaluate the appropriate retention schedule for cyber threat 

information and will develop a more definite retention 

schedule as the program continues.

Use Limitation: Response:

Please describe the steps 

taken to ensure the use of PII 

is limited to the purpose(s) 

specified in applicable 

notices.

Treasury only shares cyber security information for cyber 

security purposes. OCIP shares information that is 

actionable, relevant, timely and not available elsewhere to 

the financial sector. When responding to specific requests 

for information from the FS-ISAC, OCIP only requests 

lawfully obtained information from U.S. Government 

intelligence community and law enforcement agencies to 

address the request. All information included in CIG 

Circulars is declassified and approved for release to the FSISAC by the data owner or owners. In the event PII were to 

be included in the CIG Circulars, the inclusion of the PII in 

the CIG Circulars would be assessed by Treasury as relevant 

and necessary to describe a cyber threat to the financial 

services sector.

The CIG Circulars are produced to the FS-ISAC pursuant to 

the TLP25 initially established by the U.S. Department of 

Homeland Security and adopted with modifications by the 

FS-ISAC. Most of the CIG Circulars are identified as TLP 

Green, which permits sharing between peers, trusted 

government and critical infrastructure partners, and service 

providers, but not via publicly accessible channels. FSISAC explains the Traffic Light Protocol to its members. FSISAC distributes the Circulars to critical infrastructure 

owners in other sectors through the National Council of 

ISACs and also to members of the DHS Homeland Security 

Information Network (HSIN) Financial Services Portal. 

 

25 For more information on the TLP, see: https://www.us-cert.gov/tlp. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

43 | Page

Data Quality and Integrity: Response:

What steps are taken to 

ensure the continued quality 

and integrity of data 

maintained by the project or 

system?

Treasury relies heavily on the accuracy of the information 

provided by the Law Enforcement and Intelligence 

Agencies. The information obtained by OCIP is lawfully 

collected by other U.S. government agencies and only 

includes information approved for release by the U.S. 

government data owner or owners to the FS-ISAC, for 

network defense purposes.

What steps are taken to 

ensure information 

maintained in the system is 

accurate, timely, relevant, 

and complete?

Treasury relies heavily on the accuracy of the information 

provided by the Law Enforcement and Intelligence 

Agencies. The information obtained by OCIP is lawfully 

collected by other U.S. government agencies and only 

includes information approved for release by the U.S. 

government data owner or owners to the FS-ISAC, for 

network defense purposes.

Please describe the method 

for eliminating PII that is no 

longer needed.

Treasury’s Office of Privacy, Transparency, and Records 

reviews OCIP CIG Circulars and has yet to specifically 

identify PII in CIG Circulars. PTR will continue to review 

CIG Circulars to identify PII and work with OCIP to ensure 

that unnecessary PII is eliminated. 

Security: Response:

If data from the system is 

sent electronically, what 

methods are in place to 

ensure appropriate 

safeguards apply?

The information is distributed to the financial sector and 

other critical infrastructure partners by electronic means. 

The dissemination is limited by the Traffic Light Protocol 26

and includes a statement that the information is “NOT FOR 

POSTING ON ANY PUBLIC-FACING WEBSITE.”

Accountability and 

Auditing:

Response:

Please describe any agency 

oversight mechanisms that 

apply to the system.

PTR works with OCIP to review CIG Circulars that are 

released to the financial services sector. This provides a layer 

of oversight for the potential sharing of PII. 

 26 For more information on the TLP, see: https://www.us-cert.gov/tlp.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

44 | Page

Civil Liberties Considerations:

The Office of Privacy, Transparency, and Records reviewed this activity, its standards 

and the criteria for participation in it, and found no significant civil liberties issues 

requiring discussion and assessment at this time.

PCL Risks and Recommendations 

Risk: Impact:

Please explain the risk 

associated with the accuracy 

of the information. 

As the distributor of this information, Treasury risks 

distributing inaccurate information from other agencies in 

this program. Without a way to verify information, Treasury 

is at risk of providing inaccurate information to the private 

sector. Any distributed inaccurate information could 

potentially have negative impacts on the effectiveness of 

cybersecurity in the private sector.

Please describe risk that 

Treasury is retaining 

information for a longer 

period than necessary. 

There is a risk that Treasury’s retention of information 

shared for cyber security purposes is not limited. Treasury is 

working to develop an appropriate retention schedule that 

will ensure that the information, and potential PII shared in 

the program is not retained for a longer period than 

necessary.

Cyber Security Information Sharing Summary 

Treasury has conducted its review for the reporting period and has determined that the limited 

role the Department plays in the Cyber Security Information Sharing raises no broader PCL 

issues, policy considerations, nor legal considerations. Treasury will continue to evaluate its role 

in the program and may develop a more thorough privacy assessment, as that role expands or 

changes for future reports. 

Detailed Analyses of Identification of Critical Infrastructure at Greatest Risk under Sec. 9 

of EO 13636 

Section 9. Identification of Critical Infrastructure at Greatest Risk: Within 150 days of the 

date of this order, the Secretary shall use a risk-based approach to identify critical infrastructure 

where a cybersecurity incident could reasonably result in catastrophic regional or national 

effects on public health or safety, economic security, or national security. In identifying critical 

infrastructure for this purpose, the Secretary shall use the consultative process established in 

section 6 of this order and draw upon the expertise of Sector-Specific Agencies.

Heads of Sector-Specific Agencies and other relevant agencies shall provide the Secretary with 

information necessary to carry out the responsibilities under this section. The Secretary, in 

coordination with Sector-Specific Agencies, shall confidentially notify owners and operators of 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

45 | Page

critical infrastructure identified under subsection (a) of this section that they have been so 

identified, and ensure identified owners and operators are provided the basis for the 

determination. 

Treasury does not collect or disseminate PII in this program. Therefore, an analysis of the 

privacy and civil liberties concerns of this program at Treasury is not necessary. 

Conclusion 

Treasury continues to play a minor role in the distribution information to the financial services 

sector. Treasury will continue to assist in the sharing of cybersecurity information while 

protecting privacy and civil liberties. If Treasury’s role expands or the Department substantially 

changes its activities under the order, we will provide a comprehensive privacy and civil liberties 

assessment of those activities in future reports.

 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

46 | Page

PART III: DEPARTMENT OF DEFENSE
2016 EO 13636 Privacy & Civil Liberties Assessment Report

47 | Page

Ms. Karen L. Neuman

Chief Privacy Officer

U.S. Department of Homeland Security 

Washington, D.C. 20528 

Dear Ms. Neuman:

I write as the Department of Defense (DoD) Privacy and Civil Liberties Officer. Pursuant to the 

requirements of Section 5 of Executive Order (EO) 13636, “Improving Critical Infrastructure 

Cybersecurity”27 and Presidential Policy Directive 21 (PPD-21), “Critical Infrastructure Security 

and Resilience,”28 this letter supplements DoD’s privacy and civil liberties assessments of the 

Defense Industrial Base (DIB) Cybersecurity/Information Assurance (CS/IA) Program contained 

in the 2014 and 2015 EO 13636 Privacy and Civil Liberties Assessment reports. 

For the 2016 report, the DoD decided against replicating its 2014 and 2015 privacy and civil 

liberties assessments because the DIB CS/IA Program policies and procedures have not 

materially changed. Instead, this letter briefly summarizes DIB CS/IA Program activities that 

were carried out during Fiscal Year (FY) 2015, October 1, 2014 through September 30, 2015, in 

accordance with privacy and civil liberties safeguards. 

EO 13636 establishes policy directing the U.S. Federal Government to work together with U.S. 

private sector entities to strengthen the security and resilience of the Nation’s critical 

infrastructure against cyber threats. Section 5 requires senior agency officials for privacy and 

civil liberties to incorporate privacy and civil liberties protections into such activities, to conduct 

assessments of those activities, and submit the assessments to the Department of Homeland 

Security for compilation and publication of a public report. Section 5(b) adds that the report 

shall be reviewed on an annual basis and revised as necessary. 

The DoD’s privacy and civil liberties assessment focuses on the activities of the DIB CS/IA 

Program. The DIB encompasses the DoD, U.S. Federal Government, and private-sector 

worldwide industrial complex with capabilities to perform research and development, design, 

produce, deliver, and maintain military weapon systems, subsystems, components, or parts to 

meet military requirements. PPD-21 designates the DoD as the Sector-Specific Agency (SSA) 

for the DIB. The DoD established the DIB CS/IA Program to enhance and supplement DIB 

capabilities to safeguard DoD information that resides on, or transits, DIB unclassified 

information systems. Cyber incident reporting and related activities under this program allow 

the DoD to assess damage to critical programs when defense information is compromised. The 

DIB CS/IA Program includes a voluntary information sharing component under which DIB 

companies and the government agree to share cyber threat information out of a mutual concern 

for the protection of sensitive, but unclassified information, related to DoD programs on DIB 

company networks. Through collaboration and information sharing under this program, DoD 

and DIB participants increase cyber situational awareness and capabilities to counter malicious 

cyber activity.

 

27 Available at https://www.gpo.gov/fdsys/pkg/FR-2013-02-19/pdf/2013-03915.pdf. 28 Available at https://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-criticalinfrastructure-security-and-resil.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

48 | Page

As noted above, the structure and activities of the DIB CS/IA Program have not materially 

changed since DoD’s submissions to the 2014 and 2015 reports. DoD’s submission to the 2014 

report29 assessed the activities of the DIB CS/IA Program based upon the Fair Information 

Practice Principles (FIPPs). For the 2015 report30, DoD enhanced its privacy and civil liberties 

assessment of the DIB CS/IA Program by incorporating constructive feedback and suggestions 

provided by the Privacy and Civil Liberties Oversight Board. Both assessments concluded that 

the DIB CS/IA Program protects our Nation’s critical infrastructure from cyber threats in a 

manner that preserves individual privacy and civil liberties. 

In FY 2015, the DoD expanded industry participation in the DIB CS/IA Program to 128

companies. Each of these participating DIB companies agreed to protect individual privacy and 

civil liberties before reporting any cyber incidents discovered on its networks that resulted in an 

actual or potential compromise of DoD information. This voluntary agreement includes 

compliance with Title 32 of the U.S. Code of Federal Regulations (CFR), Part 236, “Department 

of Defense (DoD) – Defense Industrial Base (DIB) Voluntary Cyber Security and Information 

Assurance (CS/IA) Activities.”31 32 CFR Part 236 places responsibility on DoD and each DIB 

company to conduct DIB CS/IA Program activities in accordance with applicable laws and 

regulations, including restrictions on the interception, monitoring, access, use, and disclosure of 

electronic communications or data. 32 CFR Part 236 also requires the DIB company to perform 

a legal review of its policies and practices that support its program activities before sharing any 

information with the Government.

Additionally, the DoD began updating DIB CS/IA Program documentation in FY 2015 to 

increase transparency about how DoD and DIB companies maintain personally identifiable 

information (PII) in electronic form, including PII embedded in information shared for cyber 

security analysis. Specifically, the DoD reviewed the Privacy Impact Assessment (PIA) for the 

DIB Cybersecurity Activities32 and the System of Records Notice (SORN) for the DIB

Cybersecurity (CS) Activities Records33 to ensure that adequate privacy safeguards exist for all 

information maintained by the DIB CS/IA Program. This review verified the legal authority for 

collecting and storing DIB CS/IA Program records, the individuals about whom the records are 

collected, the type of information collected, and how the records are used. The DoD published 

updates to both documents in FY 2016 and will include details of the revisions in its submission 

to the 2017 report. 

 29 Available at http://www.dhs.gov/publication/executive-order-13636-privacy-and-civil-liberties-assessment-report2014.

30 Available at http://www.dhs.gov/publication/2015-executive-order-13636-privacy-and-civil-liberties-assessmentreport. 31 Available at http://www.gpo.gov/fdsys/pkg/CFR-2013-title32-vol2/pdf/CFR-2013-title32-vol2-part236.pdf. 32 Available at http://dodcio.defense.gov/Portals/0/Documents/DIB%20CSIA%20PIA_FINAL_signed_30jun2011_VMSS_GGMR_RC.pdf. 33 Available at 

http://dpcld.defense.gov/Privacy/SORNsIndex/DODwideSORNArticleView/tabid/6797/Article/570553/dcio01.aspx.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

49 | Page

The voluntary reporting under the DIB CS/IA Program focuses on sharing cyber threat indicators 

that participating DIB companies believe are valuable in alerting the Government and other DIB 

CS/IA Program participants, as appropriate, to better counter threat activity. It does not replace 

or duplicate mandatory reporting required by law, regulation, policy, or contractual obligations. 

This includes mandatory reporting requirements under Section 941 of the National Defense 

Authorization Act (NDAA) for FY 2013 and Section 1632 of the NDAA for FY 201534, which 

require defense contractors to report successful penetrations of covered contractor networks that 

affect or have the potential to affect covered defense information, or incidents that affect a 

contractor’s ability to provide operationally critical support. 

The NDAA’s mandatory reporting requirements for defense contractors are levied at DoD in 

contractual language. DoD implements the requirements through Defense Acquisition 

Regulations System (DFARS) Case 2013-D018, "Network Penetration Reporting and 

Contracting for Cloud Services", published as an interim rule on August 26, 2015.35 This rule 

establishes the same processes and systems for mandatory cyber incident reporting that already 

exist for voluntary reporting under the DIB CS/IA Program, and requires defense contractors to 

rapidly report successful penetrations of their unclassified networks or information systems 

while also ensuring that privacy and civil liberties protections continue to be effective. 

Overall, the DIB CS/IA Program’s privacy and civil liberties framework provides a multilayered approach to the incorporation of the FIPPs, as well as other privacy and civil liberties 

protections guaranteed by Federal law and DoD regulations, policies, and procedures. The 

activities of the DIB CS/IA Program in FY 2015 complied with these privacy and civil liberties 

safeguards. In FY 2016, DoD will continue to monitor the DIB CS/IA Program to ensure that all 

privacy and civil liberties controls are functioning properly. 

 

Sincerely,

Peter Levine

DoD Privacy and Civil Liberties Officer

 

34 Sections 941 and 1632 are codified in Sections 391 and 393 of Title 10, United States Code. Available at 

http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title10-

chapter19&saved=|KHRpdGxlOjEwIHNlY3Rpb246MzkxIGVkaXRpb246cHJlbGltKQ%3D%3D|||1|false|prelim&e

dition=prelim. 35 Available at https://www.federalregister.gov/articles/2015/08/26/2015-20870/defense-federal-acquisitionregulation-supplement-network-penetration-reporting-and-contracting-for. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

50 | Page

PART IV: DEPARTMENT OF JUSTICE
2016 EO 13636 Privacy & Civil Liberties Assessment Report

51 | Page

I. Introduction

Executive Order (“EO” or “Executive Order”) 13636 aims to strengthen the cybersecurity of 

critical infrastructure by increasing information sharing, and by jointly developing and 

implementing a framework of cybersecurity practices with industry partners.36 The EO requires 

agencies to coordinate their activities under the EO with their Senior Agency Officials for Privacy 

and Civil Liberties (SAOPCL), and to ensure that privacy and civil liberties protections are 

incorporated into such activities based upon the Fair Information Practice Principles (FIPPs) and 

other privacy and civil liberties policies, principles, and frameworks. Annually, the SAOPCLs are 

to provide written assessments of agencies’ activities under the EO to the Department of Homeland 

Security (DHS) for consideration and inclusion in a government-wide report compiled by the DHS 

Privacy Office and Office for Civil Rights and Civil Liberties. 

The Department of Justice (“DOJ” or “the Department”) submitted privacy and civil liberties 

assessments for inclusion in the 2014 and 2015 government-wide reports. Both assessments 

detailed the Department’s activities implementing Section 4(a) and Section 4(b) of the EO. In 

addition, the 2015 assessment included a description of the Department’s privacy and civil liberties 

framework, as well as the Department’s cybersecurity framework. The Department engages in 

cybersecurity information sharing under the EO through activities undertaken by the Federal

Bureau of Investigation (FBI). Accordingly, the 2015 assessment included descriptions of FBIspecific frameworks and protections for privacy and civil liberties, as well as detailed assessments 

of two FBI activities that, although not undertaken specifically pursuant to EO 13636, align with 

the goals of the EO.37 This assessment covers the timeframe from October 1, 2014 to September 

30, 2015. 

II. Implementation of Section 4(a)

Section 4(a) of EO 13636 establishes as the policy of the U.S. Government the requirement to 

increase the volume, timeliness, and quality of cyber threat information shared with U.S. private 

sector entities so that these entities may better protect and defend themselves against cyber threats. 

Section 4(a) also requires the DHS Secretary, the Attorney General (AG), and the Director of 

National Intelligence (DNI) to issue instructions to ensure the timely production of unclassified 

cyber threats to the U.S. homeland that identify a specific targeted entity (“cyber threat reports”). 

The instructions are to address the need to protect intelligence and law enforcement sources, 

methods, operations, and investigations. 

As noted in the Department’s 2014 assessment, the Office of the Deputy Attorney General 

(ODAG) issued a Department Order requiring the timely production of unclassified reports of 

cyber threats to the U.S. homeland that identify a specific targeted entity.38 The Order also requires 

that all actions taken pursuant to the Order must be consistent with the need to protect privacy and 

 

36 Executive Order No. 13636, Improving Critical Infrastructure Cybersecurity (Feb. 12, 2013), available at

http://www.gpo.gov/fdsys/pkg/FR-2013-02-19/pdf/2013-03915.pdf. 37 These two activities, iGuardian and Malware Investigator, were assessed in detail in the 2015 report and will not 

be further elaborated upon in this assessment. As noted in the 2015 report, these activities do not fall within the 

scope of EO 13636. This report focuses on Cyber Guardian, which implements Section 4(b) of EO 13636. 

38 DOJ Order 3393, Issuing Instructions Pursuant to Executive Order 13636 Regarding the Timely

Production of Unclassified Reports of Cyber Threat Information (2013).
2016 EO 13636 Privacy & Civil Liberties Assessment Report

52 | Page

civil liberties. The implementation of Section 4(b), discussed below, addresses the plan of the 

United States government to address sharing cyber threat information with the private sector by 

coordinating the interagency management of cyber threats and the ultimate notification to specific 

targeted entities.

III. Implementation of Section 4(b)

Under Section 4(b) of EO 13636, the DHS Secretary and the AG, in coordination with the DNI, 

are required to establish a process that rapidly disseminates cyber threat reports to the targeted 

entity. Such a process shall also, consistent with the need to protect national security information, 

include the dissemination of classified reports to critical infrastructure entities authorized to 

receive them. Finally, Section 4(b) of EO 13636 requires the DHS Secretary and the AG, in 

coordination with the DNI, to establish a system to track the production, dissemination, and 

disposition of these reports, the so-called “4(b) solution.” 

The Department’s 2015 assessment described the initial interagency efforts to develop the 4(b) 

solution, including the establishment of an interagency Joint Requirements Team (JRT), with 

guidance from the White House’s National Security Council (NSC). The JRT, with representatives 

from FBI, DOJ, DHS, Defense Cyber Crime Center (DC3), Defense Security Service (DSS), 

National Security Agency, and Sector Specific Agencies (SSAs) and other government 

agencies/components interested in participating in the targeted entity notification requirements and 

development process, developed and finalized a document titled, “Executive Order (EO) 13636 

Section 4(b) Support Capability Requirements for Notification to Critical Infrastructure Targeted 

Entities” (accepted April 10, 2015). This document was used as the starting point for the 

development of the requirements for the 4(b) process and to build an agreed-upon business process 

and technical solution to implement the 4(b) solution. On April 10, 2015, the NSC, through the 

Cyber Interagency Policy Committee, authorized the FBI’s National Cyber Investigative Joint 

Task Force (NCIJTF) to implement Section 4(b) of EO 13636 through the use of Cyber Guardian, 

a sharing and integration platform. Thus, Cyber Guardian is being developed and implemented by 

an interagency effort as the 4(b) solution and will be modified, as appropriate, as additional 

requirements are identified. 

The FBI conducted a Privacy Impact Assessment (PIA) on Cyber Guardian that assessed the 

privacy risks in accordance with Section 208 of the E-Government Act of 2002,39 the Office of 

Management and Budget directives, DOJ policy, and specific FBI guidance.40 Each of these 

requirements incorporates the FIPPs (e.g., transparency; individual participation; purpose 

specification; data minimization; use limitation; data quality and integrity; security; and 

accountability and auditing) in assessing how privacy and other protections are incorporated into 

Cyber Guardian. A FIPPs assessment of Cyber Guardian is included as Attachment A. 

Cyber Guardian currently serves as the tracking system for the production, dissemination, and 

disposition of cyber threat reports from the U.S. Government that are shared with U.S. private 

 

39 See 44 U.S.C. § 3501 (note) (2012). 40 The PIA was completed by FBI and is currently under review by DOJ Office of Privacy and Civil Liberties. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

53 | Page

sector entities. Cyber Guardian offers Federal Cyber Centers41 and Intelligence Community (IC)

partners the ability to coordinate a whole-of-government response to targeted entities and victims 

of cyber incidents identified in government intelligence collections. The FBI is currently in the 

process of making Cyber Guardian available to all Cyber Centers, designated SSAs, and other 

government agencies that directly support the cybersecurity mission by providing direct access 

through the SIPRNet42 Intelink-S connection from their home agencies. This will provide a 

foundation for strengthening the defenses of all participating agencies by allowing use of a 

universal application for near real-time coordination and collaboration of all cyber targeted entity 

notifications that meet the appropriate cyber incident severity threshold. 

Today, Cyber Guardian enables government agencies with cyber missions to be aware of and deconflict cyber incidents. In the future, Cyber Guardian will be a platform for threat reports to be 

assimilated and made available for dissemination to the private sector, and is intended to have the 

capability to disseminate both unclassified and classified reports to critical infrastructure entities 

authorized to receive them. Any new capability, if developed, will be assessed for privacy and 

civil liberties protections, and the PIA will be amended as necessary. 

To gain access to the Cyber Guardian system, each agency and each individual designated to 

receive access to Cyber Guardian from such agency, as appropriate, must undertake the following:

• Complete on-site Cyber Guardian training; 

• Review, sign, and return the FBI Rules of Behavior for Other Government Agency (OGA) 

Personnel Authorized to Access Cyber Guardian (FD-889d);

• Possess and provide a valid Intelink Passport account (if accessing through SIPRNet); and 

• Obtain Agency Head authorization and signature on FBI’s Memorandum of Understanding 

(MOU) for Access to Cyber Guardian

In June 2015, the FBI initiated Phase I of its Cyber Guardian training to all designated Federal 

Cyber Centers, select SSAs, and other select government agencies with a cybersecurity mission. 

To date, the NCIJTF/CyWatch43 has coordinated and provided multiple training sessions to DHS, 

DC3, Intelligence Community Security Coordination Center, Department of Energy, Treasury, and 

DSS. Also scheduled to receive training as part of Phase I are the following additional government 

agencies: NSA/CSS Threat Operations Center, U.S. Cyber Command, and the Central Intelligence 

Agency (CIA). 

The FBI will continue to work with its Cyber Partners to identify new requirements for Cyber 

Guardian to ensure that quality cyber threat information is increasingly shared in a timely manner 

to targeted private entities that are victims of cyber threats so that these entities may better protect 

 41 Under the Enhance Shared Situational Awareness initiative, the following Federal cybersecurity centers are 

developing an information-sharing framework and shared situational awareness requirements, for sharing 

cybersecurity information: Defense Cyber Crime Center (DC3); Intelligence Community Security Coordination 

Center (IC-SCC); National Cybersecurity and Communications Integration Center (NCCIC); National Cyber 

Investigative Joint Task Force (NCIJTF); National Security Agency / Central Security Service (NSA/CSS) Threat 

Operations Center (NTOC); and United States Cyber Command (USCYBERCOM) Joint Operations Center (JOC)

42 SIPRNet (SECRET Internet Protocol Network Router) is a service gateway function that provides protected

connectivity to federal, IC, and allied information at the secret level. 43 The FBI’s 24-hour cyber command center.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

54 | Page

themselves from malicious cyber threats. Further, the FBI will continue to assess any 

modifications to Cyber Guardian that may affect privacy and civil liberties protections afforded to 

individuals affected by cyber threat reporting. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

55 | Page

Attachment A

In accordance with Section 5(b) of the EO, this assessment includes an update of the activity that 

aligns with the EO during this reporting period against the FIPPs and other applicable privacy and 

civil liberties policies, principles, and frameworks. The FIPPs are instructive of the appropriate 

handling of personally identifiable information (PII) by the FBI’s Cyber Division (CyD) for the 

purpose of protecting the cybersecurity of critical infrastructure. 

In addition to the FIPPs, the FBI considers other applicable privacy and civil liberties policies, 

principles, and frameworks. For example, this chart includes information on how the FBI adheres 

to federal privacy laws such as the Privacy Act of 1974 (“the Privacy Act”)44 and Section 208 of 

the E-Government Act of 2002. The FBI has no indication of any activity that would warrant a 

separate civil liberties review. The Cyber Guardian MOU prohibits federal agencies accessing 

Cyber Guardian from submitting to Cyber Guardian, or retaining, disseminating, or otherwise 

using in connection with Cyber Guardian any information based solely on the ethnicity, race, 

gender, disability or religion of an individual or based solely on the exercise of rights guaranteed 

by the United States Constitution or the lawful exercise of any other rights secured by the laws of 

the United States.

Cyber Guardian FIPPs Chart

(a) Transparency

1. How does the FBI incorporate the principle of transparency into Cyber Guardian?

Response: The FBI incorporates transparency into Cyber Guardian45 by providing notice to users 

(currently U.S. government agencies with cyber missions) regarding its collection, use, 

dissemination, and maintenance of PII via the applicable System of Records Notices (SORNs), 

Privacy Act Statement, electronic banner, and MOU. For Privacy Act purposes, Cyber Guardian 

login information is covered under Privacy Act SORN, DOJ-002, DOJ Computer Systems 

Activity and Access Records.46 Upon login, each Cyber Guardian incident receives prompt, 

individualized review by the FBI’s National Cyber Investigative Joint Task Force 

(NCIJTF)/CyWatch to determine if additional action is warranted. Any information ultimately 

maintained by FBI would be covered under Privacy Act SORN, FBI-002, The FBI Central 

Records System, 63 Fed. Reg. 8671 (Feb. 20, 1998), as amended by 66 Fed. Reg. 8425 (Jan. 31, 

2001), 66 Fed. Reg. 17,200 (Mar. 29, 2001), and 72 Fed. Reg. 3410 (Jan. 25, 2007); and FBI022, FBI Data Warehouse System, 77 Fed. Reg. 40630 (July 10, 2012). A SORN for the Guardian 

Prime System is presently under review by DOJ and encompasses Cyber Guardian. As Cyber 

Guardian develops, the FBI will continuously assess privacy and civil protections for the program 

and may develop a separate Cyber Guardian SORN, if warranted. Additionally, the FBI has 

conducted a PIA on Cyber Guardian, under review by DOJ, which assessed the privacy risks in 

accordance with the E-Government Act of 2002. Cyber Guardian is a National Security System, 

 

44 5 U.S.C. § 552a (2012). 45 Cyber Guardian was developed from the Guardian system, which was created initially by the FBI to collect 

suspicious activity reports regarding terrorist threats and to triage, assign, and assess such information. However, 

the two applications are hosted on different sets of web application servers. 

46 DOJ-002, the DOJ Computer Systems Activity and Access Records SORN, available at: 

https://www.gpo.gov/fdsys/pkg/FR-1999-12-30/pdf/99-33838.pdf.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

56 | Page

as determined by the FBI’s Security Division. Constructive notice of these systems is provided 

by the applicable SORNs. 

Before cleared U.S. government personnel of Cyber Partners are granted access to Cyber 

Guardian, the proposed users are provided with a comprehensive Privacy Act Statement and other 

detailed information related to system use, such as information regarding monitoring and auditing 

for security purposes. Although Cyber Guardian does not provide express notice regarding the 

treatment of third party information, the Cyber Partners must agree to the Cyber Guardian 

responsibilities, set forth in the MOU, that require submission of information that is directly 

relevant to the Cyber Incident submission. This helps ensure that Cyber Guardian only collects 

limited PII that is directly relevant and necessary to accomplish the specified purpose(s) and only 

retains PII for as long as is necessary to fulfill the specified purpose(s). Pursuant to the MOU, 

each Cyber Partner agrees to notify each other if any erroneous information is disclosed pursuant 

to this program and take reasonable steps to correct such error, or if any PII is inadvertently 

disclosed. Moreover, determinations about the Cyber Guardian collected information are made 

promptly47 so that the data can move quickly through the review process. 

Further, before access to the system is granted, all authorized users will be under clear and 

conspicuous written notice through an electronic banner that information and data on the network 

may be monitored or disclosed to third parties or that the network users’ communications are not 

private. These users can then decide if they wish to use the system or not, and decide what 

information they want to transmit over the government system.

All Cyber Guardian users must agree to an FBI MOU. Accordingly, each Cyber Partner must 

acknowledge, in writing, the need to incorporate transparency while recognizing the need to 

protect sensitive information, sources, and methods. Each Cyber Partner understands that 

information submitted to Cyber Guardian is subject to applicable federal laws, including but not 

limited to the Privacy Act, the Freedom of Information Act, the Federal Records Act, and 

discovery requirements. To the extent information exchanged as a result of the Cyber Guardian 

results in a request or demand for that (or related) information from FBI files pursuant to federal 

or state civil or criminal discovery or any other request by a third-party for FBI information, users 

are advised that such disclosure may only be made after consultation with, and upon approval by, 

the FBI, or as otherwise required by law. Cyber Guardian is committed to establishing an 

atmosphere of trust among its users, and this MOU promotes better data quality and integrity. 

Once users are granted access to Cyber Guardian, a completed form may include the following 

items of information:

(1) Submitter’s contact information (such as name, phone number, and email address); 

(2) Information about submitter’s organization (this includes work-related data such as name 

and work address);

 

47 Upon identification and entry of new information, the FBI (CyWatch) immediately coordinates the information 

within their Operations Sections to assess investigative equities and impact of effecting notification. The FBI also 

utilizes the Cyber Incident Severity Schema, which was approved by the National Security Council, to assist in 

assessing urgency of coordination and notification.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

57 | Page

 (3) Threat observation information (such as when the threat was detected, how the threat was 

detected, the name of the suspected threat actor, the internet protocol (IP) address of the source 

of the threat, and whether the threat has been reported to another government agency); 

(4) Information regarding the threat’s target or objective (such as the incident sector, the 

incident type, and the IP address of the target); and 

(5) Information regarding damage/impact to submitter’s organization.

2. How does CyD ensure that issues surrounding transparency are re-evaluated on a periodic 

basis?

Response: Generally, the FBI requires all system owners to review and update privacy 

documentation every three years in accordance with the Federal Information Security 

Modernization Act of 201448 (FISMA) certification schedule and/or when the program changes 

in such a way that may raise new privacy issues. Because the system is evolving, the FBI 

anticipates continued oversight by the FBI’s privacy attorneys to ensure that issues surrounding 

transparency are appropriately addressed, and will re-evaluate whether the documentation for 

Cyber Guardian provides sufficient transparency. 

(b) Individual Participation

3. Are victims asked for consent and given the opportunity to object to the collection of their PII?

Response: Third party direct consent of the cyber threat actor is not practicable due to the need 

to protect the confidentiality of the law enforcement investigation. When Cyber Guardian users 

submit incident reports, those users consent to the use of their own PII, such as name, phone 

number, email address, and work-related data. All information that is submitted into an FBI 

database must be consistent with civil liberties policies, including prohibitions against collecting 

information solely on the basis of race.49 

Cyber data, like information obtained in any other investigation, is evaluated for accuracy before 

use. In the law enforcement context, information is evaluated and analyzed prior to its use, 

including in any enforcement action involving a criminal statute. Insofar as accuracy of 

information is related to third party consent, the Department does not separately verify third party 

consent regarding the PII that may be included within the information provided by a Cyber 

Guardian user. However, the FBI and DHS are responsible for victim notification in accordance 

with applicable laws and policies. 

4. How does Cyber Guardian ensure that the FBI CyD’s Victim Notification Process is 

implemented?

Response: Currently, Cyber Guardian’s users consist of cleared U.S. government personnel of 

Cyber Guardian partners. Thus, in most cases, the victim will not be the same entity as the Cyber 

Guardian user, but instead the submission will be on behalf of a victim. However, the FBI notifies 

victims in accordance with applicable laws and policies. The FBI will still need to develop steps, 

or may consider using the FBI’s existing Victim Notification Process to make the private sector 

entity aware of the magnitude of the cyber incident and share information with that entity as 

appropriate. 

5. Are Cyber Guardian users given the opportunity to access and correct their PII?

 

48 See Federal Information Security Modernization Act of 2014, Pub. L. 113-283, December 18, 2014, codified at 44 

U.S.C. §§ 3551 et seq., which superseded the Federal Information Security Management Act of 2002, formerly 

codified at 44 U.S.C. §§ 3541 et seq. 49 Guidance for Federal Law Enforcement Agencies regarding the Use of Race, Ethnicity, Gender, National Origin,

Religion, Sexual Orientation, or Gender Identity (DOJ Use of Race Policy) (December 2014), at 2.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

58 | Page

Response: Yes. Users may access and correct their user account information. If Cyber Guardian 

users would like to update their submissions, users are required to make a new submission or 

contact the Cyber Guardian program. 

6. Are victims given the opportunity to access and correct their PII?

Response: To the extent that a victim’s information is retrieved by name or other personal 

identifier, it would be covered under Privacy Act SORN, FBI-002, and thus the access and 

amendment provisions available under the Privacy Act are applicable to such information. 

Although FBI-002 is exempt from the access and amendment provisions of the Privacy Act, the 

FBI, in the interest of accurate record-keeping, may waive such exemptions on a case-by-case 

basis. 

Moreover, FBI-002 is not exempt from the Privacy Act’s disclosure prohibition. Therefore, if an 

individual’s PII were covered by the Privacy Act and is accessed or wrongly disclosed in violation 

of the Act, the individual may bring a lawsuit as a form of judicial redress against the Department. 

Victim information, in addition to the mechanisms listed above, is covered under Privacy Act 

SORN, FBI-002, and thus the access and amendment provisions available under the Privacy Act 

are applicable to such information. Even though the SORN is exempt from access and 

amendment under the Privacy Act, the FBI reserves the right to waive such exemptions in 

individual cases. In addition, redress is available for wrongful disclosures. Individuals have the 

right to seek judicial redress for intentional or willful disclosures of protected information, as 

well as for refusals to grant access or to rectify any errors contained in that information.

7. Describe the mechanism provided for an individual Cyber Guardian user to seek redress in 

the event of inappropriate access to, or disclosure of, their PII.

Response: System users may seek redress regarding their own contact information by contacting 

the Cyber Guardian program office. 

8. What steps are taken to ensure information maintained in the system is accurate, timely, 

relevant, and complete?

Response: Cyber Guardian incidents are reviewed in coordination with federal agencies with 

cybersecurity missions and by an FBI CyWatch investigator to determine if the incident warrants 

additional action. After this de-confliction, if the incident warrants additional action by the FBI, 

it is assigned to the appropriate FBI entity for additional review and investigation. Cyber 

Guardian has robust security mechanisms, audit capabilities, and strict user access. Cyber 

Guardian users are required to complete on-site Cyber Guardian training; review, sign, and return 

the FBI Rules of Behavior for Other Government Agency (OGA) Personnel Authorized to Access 

Cyber Guardian (FD-889d); possess and provide a valid Intelink Passport account (if accessing 

through SIPRNet); and obtain Agency Head authorization and signature on FBI’s MOU for 

access to Cyber Guardian. As previously discussed, the FBI’s MOU notifies users that any PII 

submitted must be authorized, relevant, and necessary to the submission. The obligation resides 

with the submitters to ensure they are authorized to provide information, including relevant and 

necessary PII, on the Cyber Guardian submission form. 

9. Is PII collected directly from the individual or from a third party? If from a third party, please 

describe how the program ensures the information is accurate and complete.

Response: As stated above, Cyber Guardian users are required to submit their contact 

information (such as name, phone number, and email address) and information about their 

organization (this includes work-related data such as name and work address). There may be 

cases where the Cyber Guardian user submits information about the particular threat actor, and 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

59 | Page

thus the submission may contain third party PII. As explained above, the information submitted 

will be evaluated as part of the case management process described in the Cyber Guardian PIA 

to ensure that the information submitted is accurate and complete. 

(c) Purpose Specification

10. Please provide the specific purpose(s) for the maintenance of PII within the system.

Response: Cyber Guardian is a sharing and integration platform for cleared personnel of federal 

agencies who have a cyber mission to share cyber threat information. Cyber Guardian enables 

the federal government to ensure that cyber threat incidents are shared among agencies with cyber 

missions to facilitate sharing of cyber threat reports to targeted private sector entities in 

accordance with Executive Order 13636. The specific purpose for the maintenance of PII related 

to cyber threat information is to facilitate information sharing and to implement Section 4(b) of 

EO 13636 (through the use of Cyber Guardian). 

Information lawfully obtained by the FBI is generally available to all authorized FBI personnel, 

and consequently, information may be appropriately shared and analyzed effectively to prevent 

and disrupt criminal and national security threats. Specifically, the Attorney General’s 

Guidelines for Domestic FBI Operations (AGG-DOM) “...do[es] not require that the FBI’s 

information gathering activities be differentially labeled as ‘criminal investigations,’ ‘national 

security investigations,’ or ‘foreign intelligence collections,’ or that the categories of FBI 

personnel who carry out investigations be segregated from each other based on the subject areas 

in which they operate.”50 The FBI is authorized to collect intelligence and to conduct 

investigations to detect, obtain information about, and prevent and protect against federal crimes 

and threats to the national security and to collect foreign intelligence, as provided in the FBI

Domestic Investigations and Operations Guide (DIOG) Part II.51

As a practical matter, the information submitted on the Cyber Guardian incident form relates to 

cyber incidents only, and would not generally be relevant to other investigative matters. Within 

this framework, the FBI also strictly adheres to federal and Department information sharing 

procedures and safeguarding the information that it maintains. For example, the FBI is governed 

by federal information privacy laws, such as the Privacy Act, which permits the sharing of 

protected information only with individual consent or under specified statutory exceptions. 

Currently, FBI’s Cyber Guardian has only been used for cybersecurity purposes based on the 

submissions received during the reporting period. It is important to note that the FBI may also 

receive cybersecurity information through other channels not subject to the EO, including directly 

from FBI field offices. 

11. What steps are taken to ensure the authority for the collection is valid?

Response: For initial reporting, the FBI depends on the Cyber Guardian user to ensure the 

collection of information submitted to the FBI is validly collected. If the FBI plans to open a 

case, the FBI will follow its usual case management process to ensure that the information 

submitted was validly collected. 

(d) Use Limitation

 

50 The Attorney General’s Guidelines for Domestic FBI Operations. 51 See FBI DIOG (updated November 18, 2015) (delineating protections incorporated in this report), available at 

http://vault.fbi.gov/FBI Domestic Investigations and Operations Guide (DIOG)/fbi-domestic-investigations-andoperations-guide-diog-2011-version/. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

60 | Page

12. Describe steps taken to ensure the use of PII is limited to the purpose(s) specified in 

applicable notices.

Response: To the extent that the FBI notices through analysis that the information submitted may 

be evidence of another crime unrelated to the purpose for the submission, the FBI follows 

applicable laws and policies, such as the AGG-DOM and DIOG. As previously indicated above, 

the FBI can share information as necessary to fulfill its law enforcement mission. The FBI, 

through a multilayered approach, will continue to update information sharing policies as 

necessary to examine the potential impact to privacy and civil liberties. 

(e) Data Quality and Integrity

13. What steps are taken to ensure that data is accurate, timely, relevant, and complete?

Response: For cyber threat information submitted, the likelihood that the information will be 

inaccurate, untimely, irrelevant, or incomplete is relatively low. Much of the information 

submitted is expected to be technical in nature. For information submitted that may be in 

narrative form describing the incident, and perhaps the specific threat actor, the information must 

be relevant pursuant to the FBI’s MOU that all Cyber Partners enter into. Moreover, the FBI will 

review the information in accordance with case management procedures to determine whether 

the information is actionable and relevant. In a typical scenario, information is determined to be 

relevant when there is an articulable nexus to a known or suspected cyber incident. This 

information is reviewed by trained CyWatch specialists. These multiple layers of checks and 

balances ensure that only relevant information is transferred to FBI agents. 

(f) Accountability and Auditing

14. What methods are in place to audit access to records maintained within the system?

Response: Cyber Guardian is hosted on the FBI’s Secret Enclave and monitored by the FBI. As 

part of FBI’s security functions, audit trails and user access are to be reviewed on a regular basis. 

Such compliance shall include tracking logons and logoffs, creating audit logs, review of opening 

and closing incident reviews, and other appropriate measures. Audit records will be protected 

against unauthorized access, modifications, and deletion, and will be retained for a sufficient 

period to enable verification of compliance. As noted above, Cyber Guardian is a National 

Security System maintained on the Secret enclave, which is subject to strict audit and access 

procedures. Further, all FBI employees must complete privacy training regarding the proper use 

of FBI information systems.

15. Describe any oversight mechanisms that apply to the system.

Response: Generally, the FBI requires all system owners to review and update privacy 

documentation every three years in accordance with the FISMA certification schedule and/or 

when the program changes in such a way that may raise new privacy issues. Because Cyber 

Guardian is still in its beginning stages, privacy attorneys are embedded at the program level and 

advise on the development and use of the system. As part of this advisory role, the privacy 

attorneys are examining whether additional oversight will be needed beyond general oversight. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

61 | Page

 

PART V: DEPARTMENT OF HEALTH AND HUMAN 

SERVICES
2016 EO 13636 Privacy & Civil Liberties Assessment Report

62 | Page

Introduction:

Executive Order (EO) 13636 seeks to ensure that the national and economic security of the U.S. 

is secure and resilient in the face of the ever–increasing occurrence of cyber intrusions and cyber 

threats. The main focus of EO 13636 is the nation’s critical infrastructure, which is defined in § 

2, as “systems and assets, physical or virtual, [that are] so vital to the United States that the[ir] 

incapacity or destruction . . . would have a debilitating impact on security, national economic 

security, national public health or safety, or any combination of those matters.” 

The major components of the effort to enhance our nation’s cybersecurity resiliency are

collaboration and information sharing across the public and private sectors, as well as 

establishing partnerships with the owners/operators of critical infrastructure. The Department of 

Health and Human Services (HHS) engages in information sharing in its capacity as Sector 

Specific Agency for the Healthcare and Public Health (HPH) Sector under the National 

Infrastructure Protection Plan. HHS maintains a partnership with approximately 150 major trade 

associations and companies in the HPH Sector, as well as Federal, State, Local, Tribal and 

Territorial agencies. However, as information is shared, agencies must coordinate their activities 

in order to ensure that risks to privacy and civil liberties are minimized or mitigated. HHS shares 

vetted and cleared cybersecurity information with Sector partners through meetings, conference 

presentations, webinars, teleconferences, newsletters, and an HHS-moderated page on the 

Homeland Security Information Network (HSIN) secure Web portal. Information that is shared 

is usually in the form of a finished product highlighting general threats, vulnerabilities, and/or 

protective measures, and often originates from Federal sources outside of HHS. 

EO 13636 § 5(c) requires “the Chief Privacy Officer and the Officer for Civil Rights and Civil 

Liberties of [the Department of Homeland Security (DHS) to] consult with the Privacy and Civil 

Liberties Oversight Board” (PCLOB) in reporting recommendations to “minimize or mitigate” 

the “privacy and civil liberties risks of the functions and programs” undertaken by DHS and 

other agencies, such as the Department of Health and Human Services (HHS), in compliance 

with their responsibilities under EO 13636. In addition to supplying DHS with information on its 

functions and programs related to privacy and civil liberties, HHS is responsible, under EO 

13636 § 5, for “coordinat[ing] their activities . . . with their senior agency officials for privacy 

and civil liberties and ensur[ing] that privacy and civil liberties protections are incorporated into 

[their] activities,” which are aimed at improving the security and resilience of physical and cyber 

critical infrastructure. This assessment represents HHS’s contribution to the publicly-available 

report DHS supplies annually which contains agencies’ evaluations of their activities related to 

privacy and civil liberties.

Establishing a strong national policy related to critical infrastructure security and resilience is a 

shared responsibility and requires effective organization among critical infrastructure owners and 

operators, as well as government agencies and their partners. As part of its function under 

Presidential Policy Directive 2152, HHS was designated the Sector-Specific Agency for the 

 

52 Presidential Policy Directive 21, Critical Infrastructure Security and Resilience, Feb. 12, 2013 (PPD-21), 

available at: http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-criticalinfrastructure-security-and-resil.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

63 | Page

Healthcare and Public Health Sector, as well as the Co-Sector Specific Agency for the Food and 

Agriculture Sector alongside the Department of Agriculture. 

 

Summary Description of Agency Privacy and Civil Liberties (PCL) Organization and 

Processes

HHS assists Healthcare and Public Health Sector partners in protecting their systems from 

unauthorized access, exploitation, or harm by sharing cybersecurity information and best 

practices with government agencies and external stakeholders. Through its participation in 

working groups, discussions, and other activities, HHS also works to ensure that parties have 

open communication channels to maximize the utility of cyber threat information sharing. HHS’s 

EO 13636 activities are not expected to have any significant impact on privacy or civil liberties. 

However, HHS is aware of its responsibility to analyze and mitigate risks to constitutional 

liberties that any of its activities may present. It partners with other organizations and working 

groups to propose activities and collaborate on procedures that relate to the Department’s EO 

13636 efforts, ensuring an overall Department-level of preparedness. HHS is striving to ensure 

that, however small its footprint is in counter-terrorism-related privacy and civil liberties risk

management footprint, it has mechanisms in place to proactively and effectively respond to any 

threats to individuals’ privacy and civil liberties protections that may arise.

Due to the sensitivity and risks associated with collecting, using, storing, and sharing personally 

identifiable information (PII), HHS works to protect PII by leveraging technologies or programs 

that are sensitive to those concerns. As part of the effort to mitigate risks, HHS incorporates risk 

management into every phase of its system and program development and will continue to do so. 

When HHS is charged with regulating parties that collect information about individuals, the 

Department is obligated to identify, analyze, and mitigate any concerns individuals may have 

about the impact on their privacy. 

The HHS Privacy Program

Many offices across HHS share the overall privacy policy and compliance responsibilities for the 

Department, each with its own particular role and/or subject-matter focus. One aspect of these 

responsibilities is to coordinate with one another to effectuate comprehensive implementation of 

the Department-wide response to EO 13636. The HHS privacy program collects, assesses, and 

uses significant amounts of data as part of its role as the United States Government’s principal 

agency charged with protecting the health of all Americans and providing essential human 

services. HHS focuses on collaborative efforts to address privacy concerns common to all 

information systems that are comprised of PII, working internally with Operating Divisions 

(OpDivs) and with external stakeholders to identify the most efficient platform for recognizing, 

assessing, and mitigating privacy risk. HHS will continue its current activities that focus on the 

protection of individuals’ privacy and civil liberties, such as holding regular privacy incident 

response team meetings, working with OpDivs to assist them with the responses to such 

incidents, and collaborating with and keeping open channels of communication with other 

privacy officials throughout the Department with regard to policy considerations and information 

management. HHS continues participating in discussions, councils, and working groups with the 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

64 | Page

goal of creating and maintaining appropriate data collection, use, protection, and dissemination

procedures. 

Overview of Executive Order 13636 Implementation Activities to be Reviewed and 

Assessed

We have no significant updates from our specific assessments from last year’s report; however 

we would like to report on the following areas of activity:

Critical Infrastructure Protection (CIP) Program: 

The Healthcare and Public Health (HPH) Sector Critical Infrastructure Protection (CIP) Program 

leads a public and private sector partnership known as the Healthcare and Public Health Sector

Critical Infrastructure Protection Partnership in protecting the essential goods, services, and 

functions of healthcare and public health that, if destroyed or compromised, would negatively 

affect the Nation. The HHS Office of the Assistant Secretary for Preparedness and Response

(ASPR) has been coordinating this program for more than ten years. The CIP Program works 

with its partners to develop guides and checklists to prepare facilities to bounce back after a 

disaster; implement the National Infrastructure Protection Plan (NIPP) sector partnership and 

risk management framework; develop protective programs and actions to defend against, prepare 

for, and mitigate the consequences of a terrorist attack or other hazards; provide guidance on 

Healthcare and Public Health critical infrastructure protection; communicate the needs of the 

Healthcare and Public Health Sector throughout government; measure the sector’s performance 

toward sector protection priorities; encourage information sharing among all sector partners; and 

submit sector plans and reports to DHS. 

Food and Drug Administration (FDA) Medical Device Security Efforts 

At the FDA, all medical devices are regulated based on risk. Moderate- and high-risk devices are 

generally evaluated for their safety and effectiveness before they are allowed to be sold to the 

public. Increasingly, these devices are designed to be wireless, Internet and network connected, 

which enables remarkable advances that have the potential to transform patient care. At the same 

time, this interconnectivity means cybersecurity risks need to be addressed. 

The FDA recognizes that collaboration with the private sector is essential to enhancing medical 

device cybersecurity. Engaging with all of the stakeholders in the medical device ecosystem, 

including security researchers, is an important step toward strengthening medical device 

cybersecurity. White hat hackers study medical devices and systems, looking for flaws, 

weaknesses, or vulnerabilities that, if exploited, could cause harm. White hats work with 

manufacturers, regulators, and other stakeholders to safeguard patient care and privacy without 

putting patients at risk – by revealing flaws in a controlled setting and reporting them so they can 

be proactively addressed in both current and future designs. While skilled and persistent 

adversaries seek to harm, skilled and persistent external “white hat” protectors seek to safeguard. 

Distinguishing between malicious attack by adversaries and good faith effort by security 

researchers allows medical device manufacturers to discourage the former and derive value from 

the latter. The best outcomes happen when security researchers work with medical device 

manufacturers and federal partners in a coordinated manner to identify and help address medical 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

65 | Page

device cybersecurity concerns together. The FDA highly values the researchers’ technical 

expertise and regards their contributions as essential to identifying medical device cybersecurity 

vulnerabilities, which if exploited, may result in patient harm. 

Summary of Assessment Methodology 

As stated in last year’s report, HHS continues to consult the Code of Fair Information Practice 

Principles (FIPPs), as well as more recent formulations, in evaluating its privacy functions. They 

are a basis for the Privacy Act of 197453 and most other privacy laws and policies. The FIPPs, as 

well as both domestic and international privacy statutes and regulations, and federal and state 

policies, have been consulted whenever an HHS program or activity collects information or 

raises concerns involving the collection of PII. These authorities are also consulted whenever 

there is a deployment of technology or development of a proposed regulation that raises privacy 

risks for individuals. 

Summary of Findings and Recommendations 

We continue to engage with the HHS organizations most involved with programs potentially 

under the purview of EO 13636. Much of the input for this year’s report is from ASPR, who is 

well-suited to inform the HHS Privacy Program of new issues or programs across the 

Department suitable for reporting here. 

 

Conclusion 

As with our initial report, PCLOB understands the HHS position that we do not have specific 

systems or programs that would fall under the purview of EO 13636. HHS will continue to 

protect the data it collects and maintain the rights and civil liberties of the individuals to whom 

HHS provides benefits and services. HHS looks forward to increased collaboration with its 

internal and external partners, and improved awareness and efficiency of HHS policies and 

practices.

 

53 5 U.S.C. § 552.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

66 | Page

PART VI: DEPARTMENT OF ENERGY
2016 EO 13636 Privacy & Civil Liberties Assessment Report

67 | Page

Department of Energy

Executive Order 13636, “Improving Critical Infrastructure Cyber Security,”

Section 5 Assessment of Privacy and Civil Liberties Protections

Pursuant to the requirements of Executive Order (E.O.) 13636, Improving Critical Infrastructure 

Cybersecurity, this update constitutes a review of Department of Energy (DOE) Privacy and 

Civil Liberties activities for the period ending September 31, 2015. DOE is the sector specific 

agency for energy and the Smart Grid. DOE’s previous assessment was submitted on December 

2, 2014, for inclusion in the consolidated 2014 Department of Homeland Security Report, 

consistent with the mandate of the E.O. 

DOE’s Office of Electricity Delivery and Energy Reliability (OE), the lead office for the Smart 

Grid, in coordination with the Federal Smart Grid Task Force (Task Force), continues to work 

closely with Smart Grid stakeholders to protect the privacy of consumers’ customer data. As 

reported last year, DOE has no jurisdiction to regulate or monitor either utilities or third parties 

who will be collecting or using energy usage data. As such, DOE OE, in partnership with the 

Task Force, initiated a multi-stakeholder process to develop the Voluntary Code of Conduct 

(VCC) that was modeled on the Fair Information Practice Principles, a widely accepted 

framework of privacy principles that provides the basis for the Privacy Act of 1974 and other 

privacy laws and policies.

In FY2015, the Cybersecurity Risk Information Sharing Program (CRISP) continued to expand 

under the management of the North American Electric Reliability Corporation’s (NERC) 

Electricity Information Sharing and Analysis Center (E-ISAC). CRISP is a government-energy 

sector collaboration to facilitate the timely bi-directional sharing of classified and non-classified 

threat information and develop and deploy situational awareness tools to enhance the sector’s 

ability to identify threats and coordinate the protection of critical infrastructure. As required by 

contracts with Pacific Northwest National Lab, NERC is slated to conduct its first independent 

audit of CRISP data handling procedures. 

Voluntary Code of Conduct Update 

On January 12, 2015, President Obama announced the release of the VCC final concepts and 

principles related to the privacy of customer energy usage data for utilities and third parties. The 

final concepts and principles were developed through a 22-month multi-stakeholder effort that 

was facilitated by OE in coordination with the Task Force. The VCC reflects input from 

stakeholders across the electricity industry and incorporates comments from the public through 

open meetings and a federal register notice. The VCC was rebranded as DataGuard|Energy Data 

Privacy Program in early 2015 based on feedback from consumer focus groups. Below is a 

summary of activities for the rebranded program: 

• A consumer-friendly mark was developed that provides adopting companies a visible means 

for communicating their adoption of the program and demonstrating their commitment to 

consumer privacy. DOE filed a trademark application for the DataGuard mark and is 

awaiting final approval. 
2016 EO 13636 Privacy & Civil Liberties Assessment Report

68 | Page

• Currently, 15 companies (7 utilities and 8 technology companies) have pledged to adopt 

DataGuard concepts and principles. Upon receipt of the trademark approval, a program 

launch event will take place with early adopters to highlight their leadership in this area and 

to raise awareness of the program. DOE OE will continue outreach efforts to recruit early 

adopters and raise program awareness.

• A program website was developed with both industry and consumer sections. It provides 

information on the program and its principles, and also serves as a public method for 

communicating which companies participate in the program. The industry section provides 

additional information on the importance of adopting and how to adopt, as well as a toolkit 

with communication materials that a company could use to explain the program to consumers 

or employees. Communication materials include a program fact sheet, newsletter and bill 

insert examples, website buttons, and sample press release content. In addition, a video 

targeting potential adopters was created which explains the program and the importance of 

protecting consumer privacy. 

Federal Smart Grid Task Force website:

http://energy.gov/oe/technology-development/smart-grid/federal-smart-grid-task-force

DataGuard|Energy Data Privacy Program website: 

https://www.smartgrid.gov/data_guard.html
2016 EO 13636 Privacy & Civil Liberties Assessment Report

69 | Page

PART VII: OFFICE OF THE DIRECTOR OF NATIONAL 

INTELLIGENCE
2016 EO 13636 Privacy & Civil Liberties Assessment Report

70 | Page

January 22, 2016 

Ms. Karen L. Neuman

Chief Privacy Officer

U.S. Department of Homeland Security

Washington, D.C. 20528 

Ms. Megan H. Mack

Officer for Civil Rights and Civil Liberties

U.S. Department of Homeland Security 

Washington, D.C. 20528 

Dear Ms. Neuman and Ms. Mack: 

I write as the Civil Liberties Protection Officer and the senior agency official for privacy and 

civil liberties of the Office of the Director of National Intelligence (ODNI). Pursuant to the 

requirements of Executive Order (EO) 13636 (February 12, 2013), Improving Critical 

Infrastructure Cybersecurity, this letter constitutes my review of ODNI’s cyber activities for the 

period ending September 30, 2015.1

 

Under the EO, ODNI is responsible for developing and disseminating guidance to the 

Intelligence Community (IC) for timely production of unclassified cyber products involving a 

specific, identifiable, target individual or entity. ODNI determined that the existing Intelligence 

Community Directive (ICD) 209, “Tearline Production and Dissemination,” satisfied this 

requirement. We nonetheless recommended that appropriate training be developed and, in our 

last submission, noted that ODNI CLPO in fact had completed an online training module 

suitable for that purpose. The Web-based training module (including a “knowledge check”) is 

now a mandated annual requirement for ODNI intelligence personnel, linked to system access 

for some purposes. The training addresses the requirements of the Privacy Act and the proper 

handling of personally identifiable information (PII), as well as safeguards for “protected” 

individuals in the Information Sharing Environment (ISE). The training is applicable to the 

production and dissemination of tearlines.2

 

 

1 This is our third review under EO 13636. Our first assessment was submitted on December 2, 2013 for inclusion in 

the first Department of Homeland Security (DHS) Cyber Report, published in April 2014. In that initial submission, 

we included a comprehensive assessment of the ODNI’s cyber activities under EO 13636. On February 13, 2015, we 

submitted our second review covering the period ending September 30, 2014 for inclusion in the second DHS Cyber 

Report, published in April 2015. In that second review, we did not resubmit the detailed civil liberties and privacy 

analysis that we had included in our first assessment, and instead focused on relevant updates. In this review, we 

again focus on relevant updates. For those interested in the original comprehensive assessment, please see the first 

DHS Cyber Report dated April 2014. 

2 Moreover, ODNI is implementing training on the protections for non-U.S. persons as prescribed by Presidential 

Policy Directive 28: Signals Intelligence Activities (PPD 28). This training will be relevant to the use of tearlines 

that include signals intelligence information.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

71 | Page

Our submission last year also indicated several areas that we intended to explore in furtherance 

of our responsibility to provide guidance on producing unclassified cyber products involving 

identifiable targets. An update tracking our last submission follows below:

• Data quality: The IC’s foundational guidance governing production and evaluation of 

analytic products is Intelligence Community Directive (ICD) 203, “Analytic Standards.” This 

ICD was re-issued in January 2015, and now includes the requirement that IC elements adopt 

procedures to prevent, identify and correct errors in PII. In addition, the ICD explicitly 

reinforces the principle that PII may be included in analytic product only as it relates to a 

specific analytic purpose (e.g., necessary to understand the foreign intelligence or 

counterintelligence information or assess its importance). 

• PPD 28: As we mentioned in our prior submission, Presidential Policy Directive 28: Signals 

Intelligence Activities (PPD 28) requires certain protections for personal information 

collected though signals intelligence activities, regardless of nationality. Consistent with PPD 

28, all IC elements have published policies that implement those protections. These 

protections will apply to the extent that personal information from signals intelligence is 

included in a tearline. 

• Efficacy of ICD 209: As stated in our last report, the Office of the ODNI National 

Intelligence Manager for Cyber conducted a study to assess whether ICD 209 provides IC 

professionals the requisite guidance to produce unclassified reports in a timely manner, 

including cyber reports that properly use or protect (as the case may be) information 

pertaining to a specific, identifiable, targeted entity. Feedback indicates that since the data 

call/study, the elements have worked to refine downgrade processes and handling 

instructions on disseminated FOUO products to allow them to be shared more broadly. 

Notably, the study did not produce any directly actionable result nor suggest that ICD 209 is 

insufficient. Accordingly, ODNI does not plan to revise existing or develop additional policy 

guidance in this area at this time.

• CTIIC: Our prior submission referred to the establishment of the Cyber Threat Intelligence 

Integration Center (CTIIC) within ODNI. CTIIC was recently authorized with the enactment 

of the Intelligence Authorization Act for Fiscal Year 2016. ODNI CLPO has assigned a 

CTIIC Civil Liberties and Privacy Officer to provide civil liberties and privacy guidance to 

CTIIC personnel. CTIIC’s activities currently focus on providing integrated analytic products 

to other government agencies. Accordingly, CTIIC personnel receive training regarding rules 

for disseminating information that contains information identifying or concerning a U.S. 

person. As stated in our prior submission, ODNI CLPO will assess CTIIC activities to the 

extent CTIIC becomes involved in activities covered by EO 13636.
2016 EO 13636 Privacy & Civil Liberties Assessment Report

72 | Page

It merits repeating that ODNI as an organization has not historically issued cyber tearlines within 

the scope of EO 13636, and this remains the case. Accordingly, no audit of ODNI cyber tearline 

activity has been conducted to ensure that products adequately protect identifiable targets’ 

privacy and civil liberties. Should CTIIC become directly involved with cyber tearline reporting, 

ODNI CLPO will provide CTIIC with guidance consistent with ICD 203 regarding inclusion of 

PII in analytic products, and with the training provided regarding PPD 28 (if applicable) and the 

rules regarding dissemination of U.S. persons information. 

Sincerely, 

Alexander W. Joel

Civil Liberties Protection Officer

Office of the Director of National Intelligence