From Public Intelligence

On April 19, 2010, Public Intelligence received a notice from George White, Information Security Officer for the Federal Bureau of Investigation’s Criminal Justice Information Services Division, requesting the removal of a “For Official Use Only” document posted less than one day prior. The “Criminal Justice Information Services Security Policy” is a draft document dated January 1, 2011 discussing the security procedures and implementation of future additions to the CJIS system. Mr. White asks “on behalf of the FBI CJIS Division and the Law Enforcement agencies around the nation” that the document be removed as it contains “content that could be used by someone interested in causing harm to our first responder systems used by law enforcement and non-criminal justice agencies responsible for the protection and well-being of our citizens.” We do not believe that this is the case. However, even if there were material in the document that could be used in such a manner, the document was discovered on a publicly available server where any person wishing to do harm could have covertly accessed it. Contrary to popular belief, the disclosure of security flaws do not exacerbate the threats posed by such problems. In fact, it is precisely when the information remains undisclosed that it can do the most damage. Secrecy is not security. Moreover, the nationwide databases that are incorporated via CJIS are an essential part of the so-called “fusion process” of “intelligence-led policing” that is being implemented throughout the U.S. Inside the new Intelligence Sharing Environment fusion centers and local law enforcement agencies liaison with federal authorities to manage databases that are nationally unified and contain information that is of legitimate concern to private citizens who have committed no crimes and have done nothing wrong.

According to the FBI, the CJIS was established in February 1992 to “serve as the focal point and central repository for criminal justice information services in the FBI. It is the largest division in the FBI. Programs initially consolidated under the CJIS Division include the National Crime Information Center (NCIC), Uniform Crime Reporting (UCR), and Fingerprint Identification. In addition, responsibility for several ongoing technological initiatives were also transferred to the CJIS Division, including the Integrated Automated Fingerprint Identification System (IAFIS), (NCIC 2000), and the National Incident-Based Reporting System (NIBRS).” Other databases contained within the CJIS system include:

* Stolen Vehicle System (SVS)
* Automated Boat System (ABS)
* Automated Property/Stolen Bicycle System (APS)
* Automated Firearms System (AFS)
* Wanted Persons System (WPS)
* Missing/Unidentified Persons System (MUPS)
* Automated Criminal Intelligence Index/Western States Information Network (WSIN)
* Adult Criminal Justice Statistical System (ACJSS)
* Criminal History System (CHS)
* Mental Health Firearms Prohibition System (MHFPS)
* Domestic Violence Restraining Order System (DVROS)
* Supervised Release File (SRF)
* Sex and Arson Registration (SAR)

The CJIS Division is the largest division of the Federal Bureau of Investigation and is located in a half million square foot main facility on a 986 acre (4.0 km²) tract North of Clarksburg, West Virginia. Computer systems located at this site include the National Crime Information Center (NCIC), Integrated Automated Fingerprint Identification System (IAFIS), Law Enforcement Online (LEO), National Instant Criminal Background Check System (NICS), and the Uniform Crime Reporting Program/National Incident-Based Reporting System (UCR/NIBRS). Most systems are hosted on HP Superdome computers.

Subject: FOUO Document Posting
From: george.white@leo.gov
Date: Mon, 19 Apr 2010 22:27:19 -0400
To: legal@publicintelligence.net

To the responsible parties for the content of publicintellingence.net:

On behalf of the FBI CJIS Division and the Law Enforcement agencies around the
nation I respectfully request you take down the following link and and remove
all associated content:

http://publicintelligence.net/u-s-doj-fbi-criminal-justice-information-services-cjis-security-policy-2011-draft/

This document is clearly marked For Official Use Only and is intended for a
specific community of users – not for the general public. While the content
contains no national security information it does however contain content that
could be used by someone interested in causing harm to our first responder
systems used by law enforcement and non-criminal justice agencies responsible
for the protection and well-being of our citizens.

Please take the requested action as quickly as possible.

Thank You,

George A. White
FBI CJIS Division ISO