Ensure ACJIS terminals and ancillary equipment are located in such a manner that only authorized personnel are able to read the monitor display and/or printed material.

Ensure terminals, ancillary equipment and manuals are located/secured in areas in which only authorized personnel have access. Manuals shall be located near terminals and ancillary equipment for terminal operator use.

Ensure all changes regarding the equipment connected to the ACJIS network are coordinated with the Control Terminal Agency (CTA), through the System Security Officer (SSO).

Protect against unauthorized access by:

Appointing an ACJIS Liaison.

Ensuring each employee with access to the ACJIS network information, whether directly or indirectly, is identified on an authorization list submitted to the CTA, through the SSO.

1.1 Monitoring system usage.

1.2 Enforcing system discipline.

1.3 Assuring ACJIS operating procedures are followed.

1.4 Serving as a central point in the Department for:

1.4.1 Record validations.

1.4.2 Quality control matters.

1.4.3 Dissemination of ACJIS manuals and other ACJIS publications.

1.4.4 Security matters.

1.4.5 Agency personnel authorization/training/certification.

1.4.6 Identification of Terminal Operators and Criminal Justice Practitioners on a Departmental listing.

1.4.6.1 Submission of Terminal Operator and Criminal Justice Practitioner lists to the CTA as changes occur.

1.4.7 Ensuring the viewing of the videotapes "ACJIS Operations Overview" and "National Crime Information Center (NCIC) System Security," and that participants sign and date the Videotape Viewing Log (see Attachment A) for submittal to the CTA with the semi-annual report.

1.4.8 Processing requests for information/problems identified regarding ACJIS usage.

1.4.9 Coordination with the CTA of all requests for information, training and updates.

1.4.9.1 All requests regarding the system shall be coordinated through the SSO.

1.4.10 Receiving Monthly Statistical Reports from the CTA, and routing them to the respective ACJIS Liaison for review.

1.1 ACJIS Liaisons located at Central Office shall be appointed by the Deputy Director, Assistant Director, or Bureau Administrator having responsibility for the area utilizing the ACJIS terminal site.

1.2 The ACJIS Liaison shall:

1.2.1 Submit a list of authorized Criminal Justice Practitioners and Terminal Operators to the SSO.

1.2.2 Notify the SSO of changes in personnel as they occur.

1.2.3 Coordinate training of prospective Criminal Justice Practitioners and Terminal Operators.

1.2.4 Ensure staff requesting authorization as Criminal Justice Practitioners or Terminal Operators complete a Request for Access to ACJIS, Form 607-5P, for submittal to the SSO, and maintain copies of the form for audit purposes.

1.2.5 Ensure staff view the requisite "ACJIS Operations Overview" and "NCIC System Security" video tapes, sign and date the Videotape Viewing Log (see Attachment A).

1.2.6 Maintain the Videotape Viewing Logs for a period of six months, after six months forward the logs to the SSO.

1.2.7 Coordinate and schedule the ACJIS training with the CTA through the SSO.

1.2.8 Coordinate and administer the Terminal Operator certification test for personnel within six (6) months from date of applicant's assignment to ACJIS-related duties.

1.2.9 Recertify Terminal Operators within thirty (30) days of their certification expiration date.

1.2.10 Maintain copies of Terminal Operator certificates for audit purposes.

1.2.11 Ensure ACJIS manuals and/or publications are updated.

1.2.12 Share new/updated information with Terminal Operators as it is received from the SSO.

1.2.13 Monitor ACJIS usage by reviewing the Monthly Statistical Reports.

1.2.14 Enforce system discipline.

1.2 Prior to approval, the SSO shall contact the Background Investigations Unit, who shall review their files to determine if a background investigation has been conducted/completed, to include submission of an applicant fingerprint card.

1.2.1 The SSO shall notify the CTA, in writing, of any record located.

1.2.2 If a record of any kind is found, access shall not be granted, pending review of the record by the SSO and the CTA.

1.2.3 If a determination is made that access would not be in the public interest, such access shall be denied and the Warden or Bureau Administrator shall be notified, in writing, of the access denial.

1.3 Any employee who is not authorized/approved shall not have access, whether directly or indirectly, to information obtained via the ACJIS network.

1.4 Upon approval of a request for access the Terminal Operator shall be assigned a certification number by the CTA, through the SSO.

1.4.1 Terminal Operator shall be assigned a certification number by the CTA, through the SSO. Once assigned a number. Train at least one month, and no more than six months, during which time they routinely perform ACJIS terminal operations with supervisory monitoring.

1.4.2 Complete certification within six months from the date of assignment to ACJIS-related duties.

1.4.3 The ACJIS Liaison shall ensure the employee views the requisite "ACJIS Operations Overview" and "NCIC System Security" videotapes, and forward completed Videotape Viewing Logs (see Attachment A) to the SSO every six months for submittal to the CTA with the semi-annual report.

1.5 Terminal Operators shall:

1.5.1 Train at least one month, and no more than six months, during which time they routinely perform ACJIS terminal operations with supervisory monitoring.

1.5.2 Complete their certification within six months from the date of assignment to ACJIS related duties.

1.6 The ACJIS liaison shall ensure the Terminal Operators view the requisite "ACJIS Operations Overviews" and "NCIC System Security" videotapes, and forward completed videotape viewing logs (See Attachment A) to the SSO every six months for submittal to the CTA with the semi-annual report.

1.7 Tests shall be administered in an "open book" manner to allow Terminal Operators to refer to the NCIC Operating Manual, NCIC Code Manual, ACJIS Operating Manual during the test.

1.7.1 Tests shall be administered on an individual basis only.

1.7.2 Group testing or polling of answers is prohibited.

1.8 Once certified, certification numbers are the property of the Terminal Operator. Certification numbers remain on file with the CTA, and are not reassigned. All Terminal Operators shall know their number.

1.8.1 Authorized personnel who do not test/certify shall have their certification number reassigned by the CTA.

1.9 Certification is valid for two years from the date of issuance and Terminal Operators shall be recertified within thirty days prior to the date their certification expires.

1.9.1 Terminal Operators who fail the recertification test shall receive additional training by the ACJIS Liaison and/or the SSO and shall retest within thirty days.

1.9.2 Terminal Operators whose certification has expired are not authorized to operate ACJIS terminal equipment.

1.9.3 Terminal Operators who do not wish to recertify shall notify the SSO, through their ACJIS Liaison, prior to their certification expiration date.

1.9.3.1 The assigned certification number shall be placed into inactive status by the CTA.

1.10 The SSO shall submit a written request to the CTA for an extension of a certification and/or recertification date which identifies the reason for the requested extension.

1.11 Terminal Operators transferring within the Department who wish to retain their Terminal Operator certification shall contact the gaining institution/bureau's ACJIS Liaison.

1.11.1 Terminal Operators shall transfer into a position requiring ACJIS terminal access in order to maintain their certification.

1.11.2 The gaining institution/bureau's ACJIS Liaison shall forward an updated Request for Access to ACJIS to the SSO.

1.12 Terminal Operators transferring into a position which requires that they view ACJIS information without having to have access to an ACJIS ternimal, shall contact the gaining institution/bureau's ACJIS Liaison, who shall notify the SSO of the transfer.

1.12.1 The gaining institution/bureau's ACJIS Liaison shall forward an updated Request for Access to ACJIS to the SSO. The form shall note the change from Terminal Operator to Criminal Justice Practitioner.

1.12.2 Terminal Operators who transfer into a position as a Criminal Justice Practitioner shall have their certification number placed into inactive status by the CTA.

1.13 Terminal Operators who have been placed on inactive status shall reapply for authorization to become active.

1.13.1 Terminal Operators who have been placed on inactive status and who require Terminal Operator access at a later date, shall not retest/recertify unless their certification has expired.

1.13.2 The SSO shall be notified of this change through the ACJIS Liaison.

1.14 Terminal Operators needing to upgrade their certification level (B to A) shall take the written exam for the desired level.

1.14.1 Terminal Operators needing to downgrade their certification level (A to B) do not need to take an additional exam, but shall notify the SSO, through their ACJIS Liaison, of their intention.

1.15 Terminal Operators shall submit an updated Request for Access to ACJIS to the SSO, through their ACJIS Liaison, whenever a name change occurs.

1.2 The ACJIS Liaison shall ensure the employee views the required "ACJIS Operations Overview" and "NCIC System Security" videotapes, and forward the Request for Access to ACJIS to the SSO for approval/authorization.

1.2.1 An employee who is not authorized/approved shall not have direct or indirect access, to information obtained via the ACJIS network.

1.3 Criminal Justice Practitioners transferring within the Department who wish to retain their status shall notify the gaining institution/bureau's ACJIS Liaison, who shall notify the SSO of the transfer.

1.3.1 Criminal Justice Practitioners shall transfer into a position requiring ACJIS access in order to retain their status.

1.3.1.1 Criminal Justice Practitioners transferring to a position not requiring ACJIS access shall be placed on inactive status, and their name shall be removed from the list of authorized personnel.

1.3.2 The ACJIS Liaison of the gaining institution/bureau shall forward an updated Request for Access to ACJIS to the SSO.

1.3.3 Personnel who have been placed on inactive status shall reapply for authorization to become active.

1.4 Criminal Justice Practitioners shall submit an updated Request for Access to ACJIS to the SSO, through their ACJIS Liaison, whenever a name change occurs.

1.2 All ACJIS transactions shall be documented by the Terminal Operator/ACJIS Liaison.

1.2.1 ACJIS activity shall be documented on the ACJIS Activity Log, Form 607-3P.

1.2.1.1 Terminal Operators (ACJIS) Liaisons shall maintain a copy of all ACJIS Activity Log Forms for a (12) twelve month period for audit purposes.

1.2.2 Transmission of teletype messages via the Arizona/National Law Enforcement Telecommunications Systems (ALETS/NLETS) shall be documented on the ACJIS Teletype Message Log, Form 607-4P.

1.2.3 Secondary dissemination of ACJIS information shall be documented on the ACJIS Secondary Dissemination Log, Form 607-2P.

1.3 All requests for ACJIS information shall be documented.

1.3.1 A Criminal History Information Request, Form 607-1P, shall be completed/submitted by any individual requesting information via the ACJIS network when there is no other form available (e.g., Gate Pass, Inmate Visitation Form).

1.3.1.1 Terminal Operators (ACJIS) Liaisons shall maintain a copy of all Criminal History Information Request Forms for a (12) twelve month period for audit purposes.

1.3.1.2 The purpose of a request shall be obtained from the requestor prior to accessing the ACJIS network.

1.3.2 Telephone requests for information shall not be authorized without the submittal of the appropriate form.

1.3.3 The Criminal History Information Request (or other appropriate form) shall be transmitted via fax to the Terminal Operator when it cannot be hand delivered.

1.4 Response information shall be documented on the Criminal History Information Request (or other appropriate form) whenever possible.

1.5 If/when a printout is released, the Terminal Operator shall:

1.5.1 Note on the printout precisely how, when and to whom the information was released.

1.5.2 Initial and date the printout prior to forwarding it to the authorized requestor.

1.6 Terminal Operators/ACJIS Liaisons shall maintain copies of all logs and information requests for a twelve month period, for audit purposes.

1.6.1 Printouts of criminal history record information shall be maintained only for as long as there remains any possibility that there shall be action taken as a result of the information contained in the printout.

1.6.2 Printouts of criminal history record information obtained via the ACJIS network shall never be maintained in any inmate record/file if there is no further action to be taken regarding the information contained therein.

1.6.2.1 Printouts of warrant queries are not considered criminal justice information and may be maintained in an inmate record/file.

1.6.3 Printouts shall never be maintained inside any institutional yard.

1.6.4 Printouts of identifying information shall be attached to outstanding warrants for audit purposes.

1.7 Approved methods of destruction of data obtained via the ACJIS network are:

1.7.1 Shredding - Shreds shall be properly disposed of. Shredding is the preferred method of destruction for the Department.

1.7.2 Burning - Burning shall only be used where it is legal and when it can be safely monitored and contained.

1.7.3 Censoring - Censoring is the process eliminating identifying information contained within the data.

1.2 It is incumbent upon the Department to ensure dissemination, directly or indirectly, is made only to authorized personnel. Any departure from this responsibility warrants the removal of the terminal from further ACJIS participation.

1.3 Any person who knowingly releases or procures the release of information, other than as provided by applicable rules and regulations, is guilty of a Class 2 misdemeanor.

1.4 Secondary Dissemination of information to another agency or department shall be documented on a Secondary Dissemination Log.

1.4.1 The Origin Routing Indicator of the requesting agency/department shall be used when accessing the ACJIS network for secondary dissemination.

1.5 Each employee with access to ACJIS information shall be identified on an authorization list.

1.5.1 This list is maintained by the SSO and the CTA, and shall contain the individual's name, date of birth, social security number, work location and work telephone number.

1.5.2 Each ACJIS Liaison shall maintain the authorization for their respective location, submitting revisions to the SSO as changes occur.

1.5.2.1 Only those personnel authorized as Criminal Justice Practitioners or Terminal Operators shall receive information obtained via the ACJIS network.

1.6 Radio transmissions of criminal history record information shall be restricted to information necessary to effect immediate identification or to ensure the safety of the general public, staff and inmates.

1.6.1 Radio transmissions of criminal history record information shall be avoided except in extreme emergency situations (i.e., riot, hostage, escape).

1.1.1 A negative response shall not be relied upon as an indication that the person or property inquired upon is not wanted, missing or stolen, or that no criminal history record information exists.

1.1.2 Neither a positive nor negative response shall be used as the sole basis for decision- making by the receiving party.

1.2 Name-only searches not supported by positive identification (fingerprints) may fail to result in the identification of relevant records about the subject of the search.

1.2.1 When reasonable doubt exists as to whether information obtained from the ACJIS network is the subject of the search, a fingerprint card shall be submitted to the Background Investigations Unit, or the SSO, with a Criminal History Information Request for technical comparison.

1.3 An individual shall be presumed not guilty of any charge/arrest for which there is no final disposition stated on the record or otherwise determined.

1.1.1 Administration of criminal justice, i.e., the collection, storage and dissemination of criminal history record information.

1.1.2 Entering/clearing/canceling warrants regarding inmates on parole absconder or home arrest curfew violator status.

1.1.3 Conducting background investigations of prospective employees.

1.2 Any criminal justice agency that obtains criminal justice information from the central state repository, or through ACJIS, assumes responsibility for the security of the information and shall not secondarily disseminate this information to any individual or agency not authorized to receive this information directly from the central state repository or originating agency.

1.2.1 The existence or non-existence of criminal history record information shall not be confirmed to any individual or agency not authorized to receive the information itself.

1.4.1 Use of vehicle registration or drivers license information obtained via the ACJIS network is limited to law enforcement, criminal justice, or Motor Vehicle Division purposes only. Curiosity inquiries are forbidden.

1.5 Title 18, U.S. Code, Crimes and Criminal Procedure, and A.R.S. 13-2316 outline the penalties for computer misuse or fraudulent use.

1.1.1 Staff shall report suspected violations of this Order, ACJIS policies, or misuse of the ACJIS network to the SSO, who shall attempt to determine whether a violation or misuse has occurred.

1.2 The SSO shall:

1.2.1 Provide assistance to any Warden or Bureau Administrator in any follow-up investigation into allegations of misuse.

1.2.2 Receive a copy of final reports on any such follow-up or investigation for the purpose of follow-up with the CTA and/or the Federal Bureau of Investigations NCIC audit Team.

FORMS LISTING

607-1P, Criminal History Information Request

607-2P, ACJIS Secondary Dissemination Log

607-3P, ACJIS Activity Log

607-4P, ACJIS Teletype Message Log

607-5P, Request for Access to Arizona Criminal Justice Information System

Direct - Terminal access and dissemination within an agency.

Indirect - Non-terminal access outside of an agency that has direct access.

ACJIS LIAISON - Person at each Arizona Criminal Justice Information System (ACJIS) terminal site and each Central Office Division/Bureau, designated by the Warden or Bureau Administrator, acting as the liaison between the institution/bureau and the System Security Officer (SSO).

ARIZONA CRIME INFORMATION CENTER (ACIC) - The Arizona counterpart of NCIC, available for entries and inquiries through the ACJIS network. Most ACIC and NCIC files are totally independent.

ARIZONA CRIMINAL JUSTICE INFORMATION SYSTEM (ACJIS) - A computerized network maintained by the Arizona Department of Public Safety (DPS) that is available to authorized local, state and federal criminal justice agencies. The ACJIS network is connected to two important national computer networks, the National Law Enforcement Telecommunications System (NLETS) and the NCIC. ACJIS is available on a 24 hours per day, seven days per week basis.

ARIZONA LAW ENFORCEMENT TELECOMMUNICATIONS SYSTEM (ALETS) - A telecommunications system that provides for the exchange of criminal justice information between terminals within the State of Arizona.

CONTROL TERMINAL AGENCY (CTA) - A single state agency, under a shared management concept with the Federal Bureau of Investigation (FBI), which assumes responsibility as the control terminal (or main receiving point) for the state, through and by which users in the state access NCIC information. The CTA for the State of Arizona is the Department of Public Safety.

CONTROL TERMINAL OFFICER (CTO) - Person at the CTA who is responsible for ensuring that the state's users are in compliance with applicable laws, rules and regulations governing use of NCIC information.

CRIMINAL JUSTICE INFORMATION - Information collected by criminal justice agencies that is needed for the performance of their legally authorized, required function. This includes persons (wanted, missing, unidentified), stolen property, criminal history record information (CHRI), information compiled in the course of investigations of crimes that are known or believed on reasonable grounds to have occurred, including information on identifiable persons, and information on identifiable persons compiled in an effort to anticipate, prevent, or monitor possible criminal activity.

CRIMINAL JUSTICE PRACTITIONER - Personnel authorized to view/use information received from the ACJIS network, without having direct access to an ACJIS terminal.

DISSEMINATION - The written, oral or electronic communication or transfer of criminal justice information to individual's and agencies other than the criminal justice agency that maintains the information. Dissemination includes the act of confirming the existence or non-existence of criminal history record information (CHRI).

NATIONAL CRIME INFORMATION CENTER (NCIC) - A Federal Bureau of Investigations repository of files on persons and property.

NATIONAL LAW ENFORCEMENT TELECOMMUNICATIONS SYSTEM (NLETS) - A message switching system for the interstate exchange of criminal justice information, also providing a variety of on-line help files.

SECONDARY DISSEMINATION - The dissemination of criminal justice information from an individual or agency that originally obtained the information from the central state repository, or through ACJIS, to another individual or agency authorized to receive the information.

SYSTEM SECURITY OFFICER (SSO) - A Person at an ACJIS user agency who is responsible for ensuring the agency's staff accessing the network are in compliance with all applicable laws, rules and regulations governing use of that information. The SSO acts as liaison between the user agency and the CTA. All requests regarding the ACJIS/NCIC system shall be coordinated through the SSO.

TERMINAL OPERATOR - A person certified by the CTA to access ACJIS equipment. For purposes of the Department, ACJIS Terminal Operator certifications are divided into the following two levels:

Level A - Test consists of 100 questions. Maximum testing time is three hours. This level is for operators who enter records into ACJIS, as well as modify, clear, cancel and/or locate records. These operators also interpret responses.

Level A certification within the Department is authorized only to the SSO, personnel assigned to the Central Office Communications Center, and staff in the Department's Fugitive Services Sex Offender Coordination Unit.

Level B - Test consists of 50 questions. Maximum testing time is two hours. This level is for operators who inquire into the ACJIS network and interpret responses. These operators do not enter or update records.

A.R.S. 41-1750, Criminal Identification Section.

A.R.S. 41-2201 et. seq., Arizona Criminal Justice Information System.

28 C.F.R. 20.1 et. seq., Security and Privacy Regulations, Criminal Justice Information Systems.

18 U.S.C. 1030, Fraud and Related Activity in Connection with Computers.

ARIZONA DEPARTMENT OF PUBLIC SAFETY

ARIZONA CRIMINAL JUSTICE INFORMATION SYSTEM

"ACJIS OPERATIONS OVERVIEW" AND "NCIC SYSTEM SECURITY"

VIDEOTAPE VIEWING LOG

AGENCY: ORI:

PLEASE LEGIBLY PRINT YOUR NAME, JOB TITLE AND THE VIEWING DATE BELOW:

NOTE: This viewing log shall be completed each time agency employees view the ACJIS Operations Overview and NCIC System Security videotapes. Submit completed logs to the ACJIS Access Integrity Unit each April and November, along with the Terminal Operator Certification Semi-Annual Report. The videotapes shall be maintained at your agency for continued use.