Department of Public Safety and Correctional Services

Transcription

1 Department of Public Safety and Correctional Services Information Technology & Communications Division Post Office Box 5743 Pikesville, Maryland Main N.: Facsimile N.: STAlE OF MARYLAND MARTIN O'MALLEY GOVERNOR ANTHONY G. BROWN LT. GOVERNOR GARY D. MAYNARD SECRETARY G.LAWRENCE FRANKLIN DEPUTY SECRETARY ADMINISTRATION J. MICHAEL STOUFFER DEPUTY SECRETARY OPERATIONS DAVID N. BEZANSON ASSISTANT SECRETARY CAPITAL PROGRAMS RONALD C. BROTHERS CHIEF INFORMATION OFFICER C. KEVIN COMBS DEPUTY CHIEF INFORMATION OFFICER October II, 2012 David Rocah Staff Attorney American Civil Liberties Union (ACLU) of Maryland 3600 Clipper Mill Road Suite 350 Baltimore, MD Dear Mr. Rocah, The Maryland Department of Public Safety and Correctional Services, Information Technology and Communication Division, Policy Management Unit has received your Public Information Act Request sent to the Custodian of Records dated July 30, 2012 requesting certain information in accordance with the Maryland Public Information Act. In the letter you specifically requested: "... copies of the following records created from or in effect from January I, 2006 to the present: I. All records pertaining to... policies, practices and procedures for storing, accessing and sharing data obtained through ALPR technology; 2. All records which describe or list any internal Department of Public Safety and Correctional Services (DPSCS) databases which store ALPR data; 3. All records which describe or list any servers, portals or other electronic platforms which provide access to ALPR data and are housed, hosted, maintained, and/or operated by DPSCS; 4. All records pertaining to ALPR data stored on or accessible through the "Law Enforcement Dashboard" (Dashboard), including but not limited to documents which describe: a. Whether ALPR data is stored on Dashboard and if so, what type of ALPR data is stored and for how long; b. Whether Dashboard provides users access to external databases which store ALPR data, and if so, which databases; c. Third parties, governmental or private, that may access Dashboard including what procedures third parties must go through in order to access ALPR data on or through Dashboard, and any restrictions placed on third parties regarding sharing of ALPR data stored on or accessed through Dashboard;

2 d. Any agreement to share ALPR data stored on or accessed through Dashboard with outside agencies, corporations, fusion centers, or other entities; 5. All records regarding the obtainment of ALPR data by DPSCS from local, state or federal law enforcement agencies, including but not limited to documents which describe a. Which law enforcement agencies, in Maryland or elsewhere, provide ALPR data to DPSCS; b. How frequently such data is received from those agencies; c. Any agreements regarding access, sharing, or storage of ALPR data made between DPSCS and any agency which provides ALPR data to DPSCS, including but not limited to any Memoranda of Understanding between DPSCS and that agency; 6. All records regarding the obtainment of ALPR data from non-government third parties, including but not limited to documents which describe: a. Which private databases DPSCS can access; b. Which private entities provide ALPR data to DPSCS; c. Any terms agreed upon by DPSCS in exchange for such access; 7. All records regarding the storage by DPSCS of data obtained using ALPR technology, including but not limited to documents which describe: a. What types of ALPR data are stored for any period longer than an hour; b. In what database or program the data is stored; c. How long such data is stored; d. When that data must be discarded; e. How many individual license plate scan records DPSCS currently store; 8. All records regarding access to ALPR data by DPSCS employees or officials, including but not limited to documents which describe: a. The legal justification required before an individual accesses ALPR data; b. Purposes for which the data may be accessed; c. Purposes for which the data may not be accessed;

3 d. Who may access the data, what procedures they must go through to obtain access, and who must authorize access; e. The existence or non-existence of a system that records who accesses the data, when the data is accessed, and/or for what purpose the data was accessed; 9. All records regarding sharing by DPSCS of data obtained through ALPR technology, including but not limited to documents which describe: a. What type of data is shared; b. Which databases DPSCS contributes collected ALPR data to; c. Which databases DPSCS provides or facilitates access to; d. Third parties, governmental or private, that may access ALPR data through DPSCS, including what procedures third parties must go through in order to access the data and any restrictions placed on third parties regarding the further sharing of that data; e. Any agreements to share ALPR data with outside agencies, corporations, fusion centers, or other entities; I 0. All records pertaining to privacy policies, or drafts thereof, which are produced, propagated, or used by DPSCS with respect to ALPR data, including but not limited to the "comprehensive privacy policy" developed by the Governor's Advisory Committee on LPRs; II. All training materials used to instruct employees or officials at DPSCS in ALPR data management, and/or the operation of automated records systems that contain ALPR data to which any DPSCS employee or official has access, including regional, shared, or local agency-specific ALPR databases; 12. All records pertaining to any uniform operating procedures, or drafts thereof, which are produced, propagated, or used by DPSCS." RESPONSE: DPSCS, through its Information Technology and Communications Division (ITCD) and under the direction of the Maryland Governor's Office of Crime Control and Prevention maintains the Maryland Criminal Justice Dashboard (Dashboard). The Dashboard is a web-based computer information system for authorized criminal justice personnel to view criminal justice and other information from multiple sources in a read-only format. The Dashboard integrates electronically available law enforcement/criminal justice/investigative information for criminal justice officials. There is no data stored within the Dashboard. Read-only information is available to criminal justice users with full access and/or query only criminal justice agencies with current National Crime Information Center (NCIC) Terminal Operator Certifications. All

4 information obtained via the Dashboard must be handled in compliance with applicable NCIC rules and regulations. Access to information, through the Dashboard, is limited to informational purposes only. Information on the Dashboard is not meant to be considered an original source document. If there is any action intended to be taken based upon information retrieved or viewed from the Dashboard, that information must be verified with the original submitting agency. In response to Requests #4 c and d and #9d and e, please see attached Memoranda of Understanding between DPSCS and the Metropolitan Police Department and the United States Department of Justice. These Memoranda detail the guidelines of the above referred to agencies regarding their access to the Maryland Criminal Justice Dashboard. For all other requests, DPSCS has no records in response. Some of the information you seek may be with the Maryland Department of State Police and/or the Maryland Coordination and Analysis Center. Pursuant to State Government Article (SGA) I 0-622, Annotated Code of Maryland, you are entitled to an administrative review of a decision to deny access. If requested such a review will be conducted in accordance with SGA I through I and the hearing regulations of the Maryland Department of Public Safety and Correctional Services. You may also seek judicial review under SGA I Please feel free to contact Ronald Brothers, DPSCS Chief Information Officer at or Stuart Nathan, DPSCS Principal Counsel at , should you require any additional information regarding the response to your request. yl, irector Policy Management Unit Enclosures c: Stuart M. Nathan, Principal Counsel Rick Binetti, Executive Director of Communications Ronald Brothers, Chief Information Officer File

5 MEMORANDUM OF UNDERSTANDING BETWEEN THE MARYLAND DEPARTMENT OF PUBLIC SAFETY AND CORRECTIONAL SERVICES AND THE METROPOLITAN POLICE DEPARTMENT ON DATA SHARING I. INTRODUCTION This Memorandum of Understanding (MOU) is entered into by and between the Maryland Department of Public Safety and Correctional Services (DPSCS) and the Washington, DC Metropolitan Police Department (MPD) (hereinafter collectively referred to as "the Parties"). II. OBJECTIVES To allow for MPD to transmit and access proprietary data via the Maryland Department of Public Safety and Correctional Services Local Law Enforcement Dashboard (Dashboard) that will be accessed by law enforcement personnel and other persons as authorized by law or regulation to access the data. Ill. DEFINITIONS Dashboard means a web-based application that allows authorized law enforcement and other users to view criminal justice and other information from multiple sources in a read only format. Data means factual information, especially information organized for analysis or used to reason or make decisions. Data is represented by numbers, characters, images or other methods of recording, in a form that can be input into a computer, stored and processed there, or transmitted on some digital channel. Computers nearly always represent data in binary form. IV. PURPOSE AND SCOPE a. Purpose The purpose of this MOU is to improve public safety and foster interoperability amongst Public Safety Agencies and stakeholders by the sharing of proprietary data with the law enforcement community and other persons as authorized by law or regulation to access the data

6 b. Scope This MOU establishes the Parties' responsibilities related to the transmission and access of data. c. Controlling Regulations and Laws Each Party understands that the provisions of this Memorandum are subject to the laws and regulations of the United States, District of Columbia and the State of Maryland. d. No Rights Created This agreement does not, and shall not be construed to create any rights, substantive or procedural, enforceable at law by any person in any matter, civil or criminal. e. liability Eac11 Party is responsible for its own conduct under this MOU, and retains all defenses, including immunities, available under applicable federal, Maryland and District of Columbia laws. No participant agrees to insure, defend, or indemnify any other. V. RESPONSIBILITIES a. The Parties agree that their responsibilities are to create an appropriate interface between the parties so that 1. DPSCS Staff can have read-only access to the agreed upon data for placement on the Dashboard; and 2. MPD can access data via the Dashboard. b. MPD agrees to authenticate and limit the use of the Dashboard only to those users with current National Crime Information Center (NCIC), Course Number (CN) One (1), Two (2) and Five (5) log-on identifications_ c. In consideration for the release of said data, MPD and DPSCS agrees to the following terms and limitations on the use of the data: 1. DPSCS shall use such information only for the purposes for which it has requested such information as indicated in Section IV (a). 2. MPD agrees that the data retrieved or viewed from the Dashboard is for informational purposes only and is not considered to an original source document and that any action intended to taken based upon the data retrieved

7 or viewed from the Dashboard must be verified with the original submitting agency, 3. Upon reasonable written notice, MPD may suspend furnishing the data described in this MOU, whenever a reasonable determination has been made that any terms of this MOU or related rule, procedure, or policy are violated or reasonably appear to be violated. 4. Upon reasonable written notice, DPSCS may suspend furnishing access to the Dashboard described in this MOU, whenever a reasonable determination has been made that any terms of this MOU or related rule, procedure, or policy are violated or reasonably appear to be violated. VI. EFFECTIVE DATE/ DURATION/ MODIFICATION/ TERMINATION This MOU is effective upon signing by the last participant(s) and shall remain in effect from the latest signature date unless modified or terminated. This MOU may be modified at any time by written consent of all participants, and may be terminated by either Party upon 60 days advance written notice by the terminating Party to the remaining Party. Additionally, both Parties agree to provide in writing the reasons for termination and agree to meet during the interim period for the purpose of the renegotiations or modification of the Agreement. VII. ADMINISTRATION. a. By signing this MOU on behalf of the Parties, the signer represents that they have the necessary authority to bind the participating agency for which they sign. b. This MOU is not a substitute for any statutory, regulatory or policy obligation a Party may have. Any such obligations a Party may 11ave are still binding on that Party. VIII. SPECIAL TERMS AND CONDITIONS a. This MOU will be reviewed annually and may be revised and/or amended by mutual consent by all Parties. b. The terms and conditions of this Memorandum constitute the full and complete agreement between the Parties. No other verbal or written agreement shall, in any way, vary or alter any provision of this Memorandum unless all Parties consent to vary or alter the provision in a signed writing

8 IX. RATIFICATION This Agreement has been approved for legal form and sufficiency. ~}uktj- Stuart M. Nathan Principal Counsel Maryland Department of Public Safety And Correctional Services c-7 ~~ 9/t/IY( Date Metropolitan Police Department Washington, D.C. Each of the undersigned Individuals represents and warrants that he or she is expressly and duly authorized to execute this Memorandum and to legally bind each Party as set forth in this Memorandum. ~~ t/9/o9 Ronald C. Brothers Date Chief Information Officer Maryland Department of Public Safety and Correctional Services Met opolitan Police Department W hington, D.C

9 2009 Metropolitan Police Department Washington, D.C

10 Appendix I Data Sharing MOU with Maryland Dept of Public Safety & Correctional Services (DPSCS) for MD Dashboard Access Travis Hudnall- MPD CTO has approved per this amendment being attached to Data Sharing MOU with Maryland Dept of Public Safety & Correctional Services (DPSCS) for MD Dashboard Access MOU: l> Current Data sources that MPD and DPSCS are sharing: o o o o o Arrest - Adult Warrants Incidents Mug -shot Vehicle Stop l> Any Data source in addition to the above mentioned must be requested, reviewed and approved by MPD IT

11 MEMORANDUM OF UNDERSTANDING BETWEEN THE MARYLAND DEPARTMENT OF PUBLIC SAFETY AND CORRECTIONAL SERVICES AND THE UNITED STATES DEPARTMENT OF JUSTICE ON DATA SHARING I. INTRODUCTION This Memorandum of Understanding (MOU) is entered into by and between the Maryland Department of Public Safety and Correctional Services (DPSCS) and the United States Department of Justice (DOJ) (hereinafter collectively referred to as "the Parties"). II. OBJECTIVES To allow for DOJ to access proprietary data via the Maryland Department of Public Safety and Correctional Services Local Law Enforcement Dashboard (Dashboard) for official DOJ law enforcement and national security purposes. Ill. DEFINITIONS Dashboard means a web-based application that allows authorized law enforcement and other users to view criminal justice and other information from multiple sources in a read only format. Data means factual information, especially information organized for analysis or used to reason or make decisions. Data is represented by numbers, characters, images or other methods of recording, in a form that can be input into a computer, stored and processed there, or transmitted on some digital channel. Computers nearly always represent data in binary form. IV. PURPOSE AND SCOPE a. Purpose The purpose of this MOU is to improve information sharing among federal, state, and local law enforcement and to improve public safety and foster interoperability amongst Public Safety Agencies and stakeholders by the sharing of proprietary data with the law enforcement community and other persons as authorized by law or regulation to access the data

12 b. Scope This MOU establishes the Parties' responsibilities related to the transmission and access of data. c. Controlling Regulations and Laws Each Party understands that the provisions of this Memorandum are subject to the laws and regulations of the United States, District of Columbia and the State of Maryland, including provisions concerning confidentiality of juvenile records as described in the Annotated Code of Maryland, Courts and Judicial Proceedings Article, 3-SA-27. d. No Rights Created This agreement does not, and shall not be construed to create any rights, substantive or procedural, enforceable at law by any person in any matter, civil or criminal. e. Liability Each Party is responsible for its own conduct under this MOU, and retains all defenses, including immunities, available under applicable federal, Maryland and District of Columbia laws. No participant agrees to insure, defend, or indemnify any other. f. Funding Performance of the agreement is contingent on availability of funds. Each party is to bear its own costs of performance under this agreement. V. RESPONSIBILITIES a. The Parties agree that their responsibilities are to create an appropriate interface between the parties so that DOJ can access data via the Dashboard. b. DOJ agrees to authenticate and limit the use of the Dashboard only to those users of full access and/or query only Criminal Justice Agencies with current National Crime Information Center (NCIC) Terminal Operator Certifications. c. In consideration for the release of said data, DOJ and DPSCS agrees to the following terms and limitations on the use of the data: 1. DOJ agrees that the data retrieved or viewed from the Dashboard is for law enforcement and national security purposes only, is not considered to an original source document and that any action intended to taken based upon the data retrieved or viewed from the Dashboard must be verified with the original submitting agency

13 2. Upon reasonable written notice, DPSCS may suspend furnishing access to the Dashboard described in this MOU, whenever a reasonable determination has been made that any terms of this MOU or related rule, procedure, or policy are violated or reasonably appear to be violated. 3. DPSCS will share information via the Dashboard with DOJ under an express promise of confidentiality. DOJ will protect such information from disclosure to the greatest extent possible consistent with the Freedom of Information Act, the Privacy Act of 1974, and any other applicable public access law, and applicable compulsory process (such as a court order). VI. EFFECTIVE DATE/ DURATION/ MODIFICATION/ TERMINATION This MOU is effective upon signing by the last participant(s) and shall remain in effect from the latest signature date unless modified or terminated. This MOU may be modified at any time by written consent of all participants, and may be terminated by either Party upon 60 days advance written notice by the terminating Party to the remaining Party. Additionally, both Parties agree to provide in writing the reasons for termination and agree to meet during the interim period for the purpose of the renegotiations or modification of the Agreement. VII. ADMINISTRATION a. By signing this MOU on behalf of the Parties, the signer represents that they have the necessary authority to bind the participating agency for which they sign. b. This MOU is not a substitute for any statutory, regulatory or policy obligation a Party may have. Any such obligations a Party may have are still binding on that Party. VIII. SPECIAL TERMS AND CONDITIONS a. This MOU will be reviewed annually and may be revised and/or amended by mutual consent by all Parties. b. The terms and conditions of this Memorandum constitute the full and complete agreement between the Parties. No other verbal or written agreement shall, in any way, vary or alter any provision of this Memorandum unless all Parties consent to vary or alter the provision in a signed writing

14 IX. RATIFICATION This Agreement has been approved for legal form and sufficiency.. ~~}r.~ Stuart M. Nathan Pri ncipa I Counsel Maryland Department of Public Safety And Correctional Services f)'icjslli 'Z<JtL> Date ' Each of the undersigned individuals represents and warrants that he or she is expressly and duly authorized to execute this Memorandum and to legally bind each Party as set forth in this Memorandum. -?2-d/7,(J.;:Z}t t/id Jio Ronald C. Brothers Date Chief Information Officer Maryland Department of Public Safety and Correctional Services Vance E. Hitch Chief Information Officer US Department of Justice Date?:./u J~i o 'I.8.;(~ 1-uJ/--.: Gary D. Maynard fie~) Date ' Secretary Maryland Department of Public Safety And Correctional Services c </e-;;/