Contractor Access to Information from Interstate Identification

Index

The Office of Personnel Management and other agencies have authority to disclose criminal history 

records information to private contractors performing background investigations o f government employees or prospective employees.

OPM and other agencies also have authority to permit those contractors to have controlled on-line 

access to criminal history records of individuals subject to background investigations through the 

Interstate Identification Index system.

A ugust 15, 1996 

M e m o ra n d u m O p in io n f o r t h e D e p u ty A t t o r n e y G e n e r a l

This responds to your request for our opinion concerning whether private contractors retained by the Office of Personnel Management (“ OPM” ) to conduct 

or assist in conducting background investigations of government employees (or 

prospective employees) may be granted access to the criminal history records of 

those employees that are maintained in the Interstate Identification Index system 

(“ III” ). In particular, you have asked (1) whether OPM may provide designated 

contractors with particular information gleaned by OPM from III system records 

that OPM concludes will assist the contractor in performing background investigations; or, more expansively, (2) whether the contractors may themselves be granted 

direct on-line access to all III records necessary to perform the required background investigations.

Based upon the factual circumstances outlined below, we conclude that both 

of the proposed arrangements would be lawful. Our conclusion with respect to 

the second alternative is based on the understanding that direct contractor access 

to the III system will be subject to effective mechanisms to guard against exceeding authorized access, including contractual restrictions and systems for monitoring the identity of records accessed by contractor personnel through the III 

system.

I. BACKGROUND

A.

OPM is one of several agencies responsible for conducting background investigations on federal employees and prospective federal employees for two general 

purposes: (1) authorizing employee access to classified information and (2) determining a person’s suitability for federal employment or for particular categories 

of federal employment. See 5 U.S.C. §3301; Exec. Order No. 10450, 3 C.F.R. 

936 (1949-1953), Exec. Order No. 10577, 3 C.F.R. 218 (1954-1958), and Exec.

299
Opinions of the Office o f Legal Counsel in Volume 20

Order No. 11222, 3 C.F.R. 306 (1964-1965). Under 5 C.F.R. pt. 731 (1996) 

(“ Suitability” ), OPM is also authorized to deny federal appointments when necessary to “ promote the efficiency of the [civil] service.” Id. §731.201. Among 

the factors to be considered as grounds for disqualification under that regulation 

are criminal or dishonest behavior and abuse of narcotics or alcohol. Id. §731.202.

OPM’s background investigation workload has increased substantially over the 

past ten years. The extent of that workload, the quality and cost of the background 

investigations, and the measures OPM has taken to improve its performance have 

been the subject of congressional attention and legislation. In 1985, for example, 

Senate hearings explored federal government security clearance programs in general, and OPM’s background investigation practices in particular, in considerable 

depth. See Federal Government Security Clearance Programs: Hearings Before

the Permanent Subcomm. on Investigations o f the Senate Comm, on Governmental

Affairs, 99th Cong. (1985) (“ 1985 Hearings” ). In those hearings, OPM reported 

that it had begun to use outside contractors to expand and enhance its background 

investigation capabilities. Id. at 198, 256. Those hearings also showed that the 

State Department, at that time, was already using retired federal investigators as 

private contractors to perform background investigations previously performed for 

the State Department by OPM. Id. at 287. The hearing record reveals that Congress was not only aware that certain background investigations were being “ contracted out,” but that Congress was actively exploring the benefits of expanded 

contracting out for other civilian agencies. Id.

B.

As part of the background investigation process, it is necessary for an investigating agenc[y] to have access to the criminal history record (“ CHR” ) of the 

subject.1 For many years, CHRs have been collected, maintained, and exchanged 

on a nationwide basis under the auspices of the Federal Bureau of Investigation 

(“ FBI” ) in cooperation with federal, state, and local law enforcement agencies. 

Statutory authority for the creation, maintenance, and use of that system is set 

forth in 28 U.S.C. §534. That statute directs the Attorney General, inter alia,

to “ acquire, collect, classify, and preserve identification, criminal identification, 

crime, and other records” and to “ exchange such records and information with, 

and for the official use of, authorized officials of the Federal Government, the 

States, cities, and penal and other institutions.” Id. § 534(a)(1), (4).

The FBI has complied with this mandate by acquiring CHR information (as 

well as related identifying information, such as fingerprint cards) from the states. 

The states have provided this information to the FBI and derived reciprocal benefit 

by drawing upon the FBI’s national repository of such record information for their

1 As OPM stated in the 1985 Senate hearings, “ [i]t is obvious that State and local law enforcement checks are 

an essential and irreplaceable component of any background investigation.” 1985 Hearings at 271.

300
Contractor Access to Information from Interstate Identification Index

own law enforcement purposes. In more recent years, the FBI has sought to improve and streamline this system by approving the development and implementation of the Interstate Identification Index, a computerized and more decentralized 

system of CHR exchange maintained in cooperation with the National Crime Information Center (“ NCIC” ) and participating states.

As explained to us by the FBI, the III system consists of three basic parts:

(1) the National Identification Index; (2) the National Fingerprint File; and (3) 

the actual criminal record repositories of the participating federal, state, and local 

agencies. The National Identification Index is essentially an electronic locator system for the federal and state criminal history records of individuals. The system 

database is maintained by the FBI and accessed by participants through a web 

of computer linkups. The National Fingerprint File (“ NFF” ) consists of a system 

of fingerprint records provided by participating governments and maintained by 

the FBI. The NFF serves to provide positive identification of the subjects of such 

records. Finally, the criminal record repositories maintain and make available the 

actual criminal history records of individuals.

The federal-state exchange of criminal history records pursuant to 28 U.S.C. 

§534 was originally and primarily intended for criminal law enforcement purposes. See United States Dept, o f Justice v. Reporters Comm. For Freedom o f

Press, 489 U.S. 749, 752 (1989). Although many states would also provide such 

records to federal agencies for background investigation purposes (i.e., non-criminal justice purposes) on a voluntary basis, the 1985 hearings showed that some 

states refused to do so, either as a matter of policy or due to state laws limiting 

access to such information. See H.R. Conf. Rep. No. 99-373, at 24-25 (1985), 

reprinted in 1985 U.S.C.C.A.N. 959, 967-68 (“ Conf. Rep.” ). As a result, Congress enacted 5 U.S.C. §9101, which now provides a mandatory mechanism for 

federal agencies performing background investigations to obtain CHR information 

from state and local (as well as federal) law enforcement agencies.

C.

OPM has entered into a contract with a company called US Investigations Services, Inc. (“ USIS” ) to obtain assistance in performing personnel background investigations. The contract provides that USIS “ will conduct background investigations nationwide on Federal Government applicants, employees, and contract employees performing sensitive work.” USIS Contract at 50. The contract also contains a variety of provisions restricting the use and disclosure of background information made available under the contract, including a clause prohibiting the con301
Opinions of the Office o f Legal Counsel in Volume 20

tractor from disclosing such information for any purpose other than fulfilling its 

obligations under the contract.2

We have been asked to consider the legality of two possible arrangements that 

OPM might pursue with its contractor. Under one arrangement, OPM would provide contractor personnel with only particular items of information from a subject’s CHR (including items obtained by OPM personnel from the III system) 

to enable the contractor to resolve particular questions raised by a subject’s CHR. 

For example, the contractor might be provided information concerning a particular 

criminal charge against the subject and assigned the task of ascertaining its ultimate disposition.

Under the second alternative, OPM would provide its contractors with direct 

on-line access to the III records and would leave it to the contractors to perform 

all aspects of the background investigations, albeit under OPM’s ultimate supervision. Under this arrangement, although contractor personnel would be authorized 

to access only the III records of designated investigation subjects and would be 

subject to a variety of sanctions for exceeding authorized access, their actual online access would extend to the system as a whole.3 At the same time, we understand that any attempt by users to access unauthorized records on the III system 

would be recorded by the system’s monitoring mechanisms and readily subject 

to detection.

U. ANALYSIS

A.

1. Authorized Disclosure of CHR Information.

In 1985, Congress enacted what is now 5 U.S.C. §9101 as part of the Intelligence Authorization Act for FY 1986, Pub. L. No. 99-169, tit. VIII, §801 (a), 

99 Stat. 1002, 1008 (1985). That legislation provided the Department of Defense, 

OPM, and the Central Intelligence Agency (the FBI and State Department were 

included under subsequent amendments) with the right to obtain federal, state, 

and local criminal history record information for purposes of determining the eligibility of personnel for (1) access to classified information; and (2) assignment 

to or retention in sensitive national security duties. As relevant here, the operative 

portion of this statute now provides:

2 Paragraph H.18 o f the contract, for exam ple, provides: “ Except as otherwise provided herein, any information 

made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions 

o f this contract and shall not be divulged or made known in any manner to any persons except as may be necessary 

in the performance of the contract.” Id. at 83.

3 W e have been advised by OPM that it is not technically feasible to arrange for contractor personnel to be granted 

com puter access only to the full III criminal history records of designated investigation subjects without being granted 

access to the III system as a whole. That is, the system apparently does not permit retrieval of the complete CHR 

on a subject by means of a limited access password that would confine the user's HI access solely to the records 

o f that individual subject.

302
Contractor Access to Information from Interstate Identification Index

Upon request by the [OPM or the FBI], criminal justice agencies 

shall make available criminal history record information regarding 

individuals under investigation by [OPM or the FBI] for the purpose of determining eligibility for (A) access to classified information or (B) assignment to or retention in sensitive national security 

duties.

5 U.S.C. § 9101(b)(1). The “ criminal justice agencies” required to provide the 

information include federal, state, and local agencies engaged in the administration 

of criminal justice. Id. §9101(a)(l). The “ criminal history record information” 

covered by the statute consists of

information collected by criminal justice agencies on individuals 

consisting of identifiable descriptions and notations of arrests, indictments, informations, or other formal criminal charges, and any 

disposition arising therefrom, sentencing, correction supervision, 

and release.

Id. § 9101(a)(2). This defmition encompasses CHR information contained in the 

III system.4

Section 9101 provides separate authorization for the controlled use and disclosure of the subject CHR information by the recipient agency, as follows:

Criminal history record information received under this section 

shall be disclosed or used only for the purposes set forth in paragraph (b)(1) or for national security or criminal justice purposes 

authorized by law, and such information shall be made available 

to the individual who is the subject of such information upon request.

Id. § 9101(d) (emphasis added). The text of §9101 thus indicates that some disclosure of CHR information to individuals outside the agency by the recipient agencies is contemplated and permitted. In particular, use of the term “ disclosure” 

would amount to mere surplusage, and make little sense, if construed to refer 

only to disclosure to employees within the recipient agency. See Zeigler Coal

Co. v. Kleppe, 536 F.2d 398, 406 (D.C. Cir. 1976) (statute should not be construed 

in a manner that renders some provisions superfluous). The recipient agency’s 

“ use” of the information necessarily encompasses its “ disclosure” to the agency 

employees who handle and review it. Use of the broader phrase “ disclosed or

4 It is also our understanding, based on descriptions of the III system provided to us by the FBI, that information 

made available through the in system is limited to the categories of information covered by §9101(a)(2)’s definition 

of "criminal history record information.”

303
Opinions o f the Office o f Legal Counsel in Volume 20

used” thus indicates that Congress contemplated and authorized disclosure of the 

CHR information in contexts apart from the internal use of it by agency employees. See also 5 U.S.C. § 9101(b)(3)(A) (providing for indemnification of state and 

local governments for damages resulting from “ disclosure or use” by OPM or 

the FBI of CHR information initially received from the state or local government). 

The disclosures authorized by § 9101(d) are limited to those that serve certain 

national security or criminal justice purposes or “ the purposes set forth in paragraph (b)(1)” — that is, the performance of background investigations to determine eligibility for access to classified information or suitability for sensitive positions. Disclosure of CHR information to private contractors retained to perform 

background investigations constitutes such a disclosure.

The legislative history of §9101, moreover, further supports the conclusion that 

Congress intended to authorize the disclosure of CHR information to private contractors. Congress conducted extensive hearings in 1985 on problems arising out 

of the federal government’s background investigation and security clearance process. It was those hearings that revealed that state and local governments were 

frequently refusing to make CHR information available to federal background investigators, thereby leading to the enactment of 5 U.S.C. §9101. See S. Rep. No. 

99-136, at 2 (1985). The 1985 hearings also established that OPM and the State 

Department had already begun to utilize outside contractors to help reduce their 

growing backlogs of background investigation work. 1985 Hearings at 198, 256- 

57, 287-90. As then OPM Director Donald Devine testified in explaining one 

of the key measures taken by OPM to deal with its increased background investigation workload:

[M]ost importantly in a major change [of] policy, we have been 

moving to a concept of a corps of permanent investigators consisting of OPM employees supplemented by an expanding contractor relationship with outside investigators, many of them previous OPM investigations [sic]. This measure is the only way we 

can meet the recurring surges and declines in work load without 

significant disruptions.

Id. at 198 (emphasis added). Senators at the hearing revealed not only their awareness that agencies were “ contracting out” background investigation work, but 

their considerable interest in the potential cost savings that might be achieved 

through that practice. Id. at 202 (remarks of Senator Nunn, who observed, “ [W]e 

heard testimony yesterday that the State Department had contracted out their investigative services at a cost of approximately $900 per personnel case.” ); id.

at 287-88 (additional written Committee questions and OPM responses submitted 

for the record, including the following question from the Committee: “ Should 

other civilian agencies contract out [their background investigations] like the State

304
Contractor Access to Information from Interstate Identification Index

Department to get the same quality [of] work cheaper and faster than with 

OPM?” ).

It is therefore evident that when Congress enacted §9101, it fully understood 

and accepted the fact that personnel background investigations conducted by OPM 

and the State Department were sometimes “ contracted out” to private firms or 

individuals. That understanding provides relevant perspective as to what Congress 

had in mind when it provided that recipient agencies could “ disclose” criminal 

history record information for authorized background investigation purposes.5 In 

this context, it would appear that Congress intended to authorize OPM and other 

agencies to continue their practice of, at least at times, using contractors to perform background investigations and, correspondingly, to permit those contractors 

to have access to the necessary CHR information.6

2. Controlled On-Line Access to III System.

We also conclude that OPM’s proposal to provide certain contractor personnel 

with controlled on-line access to the III system in order to review the criminal 

history records of individuals subject to background investigations is consistent 

with the requirements and restrictions of §9101. Such access, properly controlled 

to prevent unauthorized inquiries, simply constitutes another form of authorized 

disclosure under § 9101(d). It should be recognized, however, that allowing contractor personnel to have direct access to the HI system could pose an increased 

risk of abuse and litigation.

If contractors were permitted unrestricted access to the III system as a whole, 

it might reasonably be argued that such access is functionally equivalent to the 

disclosure to the contractors of all records accessible on the system. Such wholesale disclosure would plainly exceed the sort permitted under §9101, which is 

(for present purposes) limited to disclosure for the purpose of conducting required 

background investigations of government employees or prospective employees. As 

we understand it, however, the arrangement that OPM has negotiated with USIS

5 The Conference Report on the legislation provides little additional insight on the meaning o f the authorized 

disclosure provision o f 5 U.S.C. §9101(d). Conf. Rep. at 29, reprinted in 1985 U.S.C.C.A.N. at 972-73. Insofar 

as pertinent here, it merely reiterates the point that disclosures of CHR information permitted under the statute 

must be limited to those furthering the statutory purposes. We should note, however, that a reference in the Conference Report to a “ specific need" as a predicate for disclosure of CHR information refers only to certain special 

disclosures “ for national security or criminal justice purposes,” as specified in § 9101(d). Id. That "specific need” 

qualification does not relate or apply to disclosures made for the basic purpose of conducting background investigations pursuant to §9101(b)(1).

6 The Privacy Act, of course, precludes an agency from disclosing "any record which is contained in a system 

of records . . . to any person . . . except . . . with the prior written consent o f t) the individual to whom the 

record pertains, unless” a particular exemption applies. 5 U.S.C. §552a(b). Here, we understand that all those who 

will be subject to background checks conducted by USIS employees will first sign releases, authorizing the disclosure 

of CHR information to a "representative” of OPM. To avoid any confusion regarding the scope of the release, 

and to minimize the risk of litigation, we strongly recommend that OPM modify the release to clarify that the 

CHR information will be disclosed to an independent contractor retained to assist in performing background investigations. In addition, the risk of litigation would also be reduced by the issuance of a relevant routine use notification. 

See id. at §552a(b)(3).

305
Opinions o f the Office o f Legal Counsel in Volume 20

does not go this far. On the contrary, there are numerous contractual, legal, and 

practical mechanisms to deter and sanction unauthorized exploitation of III access 

in these circumstances. The USIS contract includes at least four clauses (paragraphs H.14, H.18, and H.20-21) prohibiting or sanctioning unauthorized use of 

confidential information accessed under the contract by the contractor or its employees. OPM is also authorized to revoke a contract employee’s access authorization and to bar him from work on the contract in the event of “ misconduct . . . 

affecting the integrity of an investigative product under the contract” (paragraph

H.24)— which would likely include unauthorized examination of non-subject 

CHR’s on the III system. USIS Contract at 85. Moreover, continuous system monitoring and recording of the particular records accessed on the III system provides 

an added deterrent against such abuse. By comparing the record subjects that contract personnel are authorized to examine by OPM against those that they actually 

examine (as recorded by the monitoring system), unauthorized examinations would 

be readily detectable. Finally, abuse of access to III records could also subject 

the perpetrator to criminal prosecution under some circumstances.7

Such restrictions provide the kind of limitations on access to sensitive records 

that have been upheld as adequate in comparable contexts. See, e.g., Whalen v. 

Roe, 429 U.S. 589, 598-602 (1977) (measures to preserve confidence of state 

drug prescription registry held sufficient to negate claims that potential for public 

disclosure would violate privacy rights); Hodge v. Jones, 31 F.3d 157, 165-66 

(4th Cir.), cert, denied, 513 U.S. 1018 (1994) (Maryland statutory procedures held 

adequately to limit access to child abuse information records, and thus ‘ ‘tangential 

possibility” of public disclosure through such theoretical means as improperly 

motivated state employees or fortuitous computer hackers did not implicate a constitutional privacy right). Here, we believe the above-described restrictions provide 

adequate assurance that the contractor’s access to III records will be limited to 

the background investigation purposes authorized by 5 U.S.C. § 9101(b)(1).

B.

Finally, our conclusion that §9101 authorizes the sort of disclosures contemplated by the OPM/USIS contract is not inconsistent with prior opinions of 

this office that have concluded that certain disclosures of CHR information to 

private entities were not authorized by the governing law. See Memorandum for 

William Webster, Director, Federal Bureau of Investigation, from Robert B. 

Shanks, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Missing

Children A ct (Apr. 24, 1984) (concluding that certain CHR information on missing 

persons could not be provided to private organizations); Memorandum for Joseph

H. Davis, Assistant Director, Legal Counsel Division, Federal Bureau of Investiga7 For example, the Privacy Act provides misdemeanor sanctions for “ [a]ny person who knowingly and willfully 

requests or obtains any record concerning an individual from an agency under false pretenses.” 5 U.S.C. §552a(i)(3).

306
Contractor Access to Information from Interstate Identification Index

tion, from William P. Barr, Assistant Attorney General, Office of Legal Counsel, 

Re: Proposal by Federally Chartered or Insured Financial Institutions to Disseminate FBI Criminal History Record Information to CARCO Group, Inc. (Sept. 1, 

1989) (concluding that secondary dissemination of CHR information by authorized 

private users— banks and securities firms— to other private entities who were 

in a contractual relationship with the authorized private user was not permitted); 

Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General, 

Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identification Records (June 22, 1978) (concluding that a local criminal justice agency may 

not provide private railroad police with criminal history information obtained from 

the FBI).

None of these prior opinions involved the question whether disclosure was authorized under §9101, but rather each turned on the distinct question whether 

disclosure was permitted under 28 U.S.C. §534. In short, each of these prior opinions rests on the premise that §534 only authorizes the “ exchange” of information between governmental officials, and that governmental officials who receive 

information pursuant to § 534 may not disseminate the information to private entities.8 Here, in contrast, we conclude that the disclosures at issue are authorized 

under §9101, and §534 does not purport to limit the dissemination of information 

authorized under a separate statute.

Moreover, to the extent any inconsistency might arguably exist between the 

two statutes, §534 must yield to §9101. Insofar as conflicts between two statutes 

cannot be reconciled by construction, “ the most recent and more specific congressional pronouncement will prevail over a prior, more generalized statute.” Natural

Resources Defense Council, Inc. v. EPA, 824 F.2d 1258, 1278 (1st Cir. 1987), 

citing 2A C. Sands, Sutherland on Statutes and Statutory Construction §51.02 

(4th ed. 1984). Section 9101 was enacted in 1985 to establish specific provisions 

for designated federal agencies to obtain CHR information from the states on a 

mandatory basis for purposes of conducting background investigations. Its enactment was necessitated in part by the fact that the more general provisions for 

exchange of CHR information previously provided by §534 (enacted in 1966, 

Pub. L. No. 89-554, §4(c), 80 Stat. 616) did not require the states to provide 

such information for background investigation purposes. As the more recently enacted and more specific provision, therefore, the disclosure provision of §9101 

would prevail over § 534 insofar as a conflict exists.

CHRISTOPHER H. SCHROEDER 

Acting Assistant Attorney General

Office o f Legal Counsel

8 Because we conclude that §9101 authorizes the disclosures at issue here, we need not (and do not) consider 

whether §534 might also authorize these disclosures.

307