electronic fingerprint capture options for industry · electronic fingerprint capture for industry...
TRANSCRIPT
DefenseSecurityService
ElectronicFingerprintCaptureOptionsforIndustry
Version2.0January2013IssuingOffice:DefenseSecurityServiceRussell‐KnoxBuilding27130TelegraphRdQuanticoVA22134
ElectronicFingerprintCaptureforIndustry
2
TableofContents
1.0Introduction.....................................................................................................................................3
2.0Purpose..............................................................................................................................................3
3.0DeploymentOptions.....................................................................................................................3
3.1Option1:CompanyPurchasesEquipment......................................................................................................4
3.2Option2:CompaniesSharingResources.........................................................................................................4
3.3Option3:Company(s)OfferingService............................................................................................................5
3.4Option4:ThirdPartyVendorProvidesElectronicFingerprintFile....................................................5
3.5Option5:OtherGovernmentEntities................................................................................................................6
4.0ImplementationPlan....................................................................................................................6
5.0HandlingPersonallyIdentifiableInformation....................................................................6
6.0Funding..............................................................................................................................................7
7.0TechnicalSupport..........................................................................................................................7
AppendixA..............................................................................................................................................8
AppendixB............................................................................................................................................11
AppendixC.............................................................................................................................................12
ElectronicFingerprintCaptureforIndustry
3
1.0Introduction
BymemorandumdatedJuly29,2010,theUnderSecretaryofDefenseforIntelligenceissuedarequirementforDepartmentofDefense(DoD)componentstotransitiontoelectroniccaptureandsubmissionoffingerprintimagesinsupportofallbackgroundinvestigationsbyDecember31,2013(e‐Fingerprintmemo).InanefforttocomplywiththismandatetheDefenseSecurityService(DSS)isprovidingguidancetoassistcompaniesparticipatingintheNationalIndustrialSecurityProgram(NISP)totransitiontoelectronicfingerprinting.Additionally,thistransitionwillsupportgoalsestablishedbytheIntelligenceReformandTerrorismPreventionActof2004andtheimplementationofHomelandSecurityPresidentialDirective‐12.
2.0Purpose
ThepurposeofthisdocumentistooutlinetheoptionsavailableforclearedcompanieslistedintheIndustrialSecurityFacilitiesDatabasetosubmitelectronicfingerprintfilestotheDefenseManpowerDataCenter(DMDC)forNationalIndustrialSecurityProgram(NISP)applicants.TheDMDCprovidestheSecureWebFingerprintTransmission(SWFT)enablingindustryuserstosubmitelectronicfingerprintsanddemographicinformationforapplicantsrequiringabackgroundinvestigationforapersonnelsecurityclearance.OPMreceivesthehardcopyfingerprintsandscansthefingerprintstoanElectronicFingerprintTransmissionSpecification(EFTS)filetoforwardtotheFederalBureauofInvestigation(FBI).Paper‐basedcapture,submissionandprocessingoffingerprintsarepronetoerrorsandaretimeconsumingastheyaremailedtotheOfficeofPersonnelManagement(OPM).TheSWFTapplicationeliminatesthemanualpaperprocess(hardcopyfingerprints),expeditestheclearanceprocess,andprovidesend‐to‐endaccountabilityforPersonallyIdentifiableInformation(PII)data.
3.0DeploymentOptions
ThefollowingoptionsofferalternativesforIndustrytosubmitfingerprintselectronicallytoinitiatethebackgroundinvestigation.Industrymayimplementoneormoreoptionsbasedonfunding,missionneedsandgeographiclocations.Companiesmayacquireelectronicfingerprintcapture/hardcopyscandevicesorleverageotherserviceproviders.TheFBI‐certifiedproductlistislocatedonthefollowingwebsite:FBI‐ProductList.ProceduresonhowtoregisterforSWFTarelocatedontheDMDCwebsite,underPersonnelSecurity/Assurance,SWFT:DMDC‐SWFTHomepage.Priortoworkingwithanyserviceprovidercollectingand/ortransmittingfingerprintstoSWFTandOPM,pleasenote,thesevendorsmustbevettedthroughtheSWFT/OPMregistrationprocesspriortothesubmissionofasubject’sprints.
ElectronicFingerprintCaptureforIndustry
4
3.1Option1:CompanyPurchasesEquipment
Thisoptionallowscompaniestopurchaseelectronicfingerprintcapture/hardcopyscannersinordertosubmitfingerprintselectronicallytoSWFT.IndustrycompaniesmaypurchaseequipmentandsoftwareusingtheFBI‐certifiedproductlocatedonthefollowingwebsite:FBI‐ProductList.
3.2Option2:CompaniesSharingResources
Thisoptionallowsmultiplecompaniestosharethecostofpurchasingelectronicfingerprintcapture/hardcopyscandevices.Beyondtheinitialcosts,thisoptionmayrequirearecurringmaintenancefeeforsustainment.IfCompanyAissubmittingonbehalfofCompanyB,Figure2showsthattheowning/servicingFacilitySecurityOfficer(FSO)doesnothavetobeinvolvedintheactualsubmissionofthefingerprintstoSWFT.
Ifcompaniesaresharingresourcesbutsubmittingtheirownelectronicfingerprintsthentheequipmentandsoftwareshouldsupportmultiplepre‐configuredCompanyprofiles.InFigure2atheelectronicfingerprintfileisprovidedbacktotheFSOwhowillsubmitthefiletoSWFT.
ElectronicFingerprintCaptureforIndustry
5
3.3Option3:Company(s)OfferingServiceThisoptionallowsCompanyPurchasedEquipmenttobeofferedasaserviceto
supportothercompaniesinsubmittingelectronicfingerprintstoSWFT.Thisoptionpermitsaclearedcompanytosubmitelectronicfingerprintsonbehalfofotherclearedcompanies.Clearedcompaniesmustsubmitaletterofauthorizationoncompanyletterhead,signedbyaKeyManagementPersonnel(KMP)orcorporateofficialauthorizinganotherclearedcompanytosubmitelectronicfingerprintsontheirbehalf.
3.4Option4:ThirdPartyVendorProvidesElectronicFingerprintFileThisoptionallowsacompanytoreceivetheelectronicfingerprintfilefromathirdpartyvendorthatisanFBIapprovedchanneler.ThethirdpartyvendorcollectsthefingerprintsandsavesthefileintherequiredformattomeetSWFT,OPMandFBIstandards.Thevendorprovidestheelectronicfingerprintfiletothecompanyusingagreeduponfiletransfermethods.Theowning/servicingFSOuploadsthefiletoSWFT.ThethirdpartyvendormustcoordinatethroughthesponsoringFSOtoregistertheirequipmentwithSWFTpriortoprocessinganyNISPapplicants.ThethirdpartyvendormaysubmitelectronicfingerprintfilestoSWFTonbehalfofaclearedcompanywithaletterofauthorization.
ElectronicFingerprintCaptureforIndustry
6
3.5Option5:OtherGovernmentEntities
ThisoptionallowsIndustrytopartnerwiththemilitaryservicesandothergovernmentagenciesparticipatingintheNISP(seeAppendixC)forelectronicfingerprintsubmissions.MilitaryservicesandgovernmentagenciesmayleveragetheirelectronicprocessestosubmitdirectlytoOPM.ItisnotnecessarytousetheDSSSubmittingOfficeNumber(SON)andSecurityOfficeIdentifier(SOI)tosubmitelectronicfingerprintsthroughagovernmententity.OPMwillmatchthefingerprintresultstotheSF86submissiontoinitiatethebackgroundinvestigationbyusingtheindividual’ssocialsecuritynumber.TheSF86submissionwillincurtheinvestigationcosttoDSSwhichincludestheFBIfingerprintcheck.
4.0ImplementationPlan
Companiesmaydeploymultipleoptionsdependingonhowwidespreadtheirclearedpopulationis,aswellasotherfactorsthatmayapplytotheirorganization.ASWFTaccountmaybenecessaryandFSOsshouldreviewtheSWFT‐Registration,AccessandTestingProceduresdocumenttoobtaininformationongainingaccesstoSWFTandregisteringequipment,ifrequired.SinceOption5allowsfingerprintstobeelectronicallysubmitteddirectlyfromagovernmentagencytoOPM,SWFTwillnottrackthesesubmissions.
5.0HandlingPersonallyIdentifiableInformation
SafeguardingPersonallyIdentifiableInformation(PII)istheresponsibilityofeveryFederalagencyandallusersofFederalinformationandinformationsystems.AsauserofDoDinformationsystems,regardlessofwhethertheyaremilitary,civilian,oracontractorpersonnel,theyareresponsibleforprotectingPIIfromunauthorizeduseordisclosure,asrequiredbyFederallawsandDoDregulations.InordertosupportauthorizedPIIdatasharing,DSSrecommendsthefollowing:
1. Companies/vendorswhowishtoprovidefingerprintservicestoothercompaniesenterinanagreementwitheachother,allowingtheserviceprovidertohavetheirSWFTaccountbeassociatedwiththeothercompany’sCAGECode.DMDCwillreceiveacopyofanysuchagreementpriortoassociatingSWFTaccountwithCAGECodesofother/unrelatedcompanies.
2. Intheabsenceofanagreement,eachrequestforaddingaCAGECodetoexistingSWFTaccountoftheserviceproviderwillrequireaseparateSystemAccessRequest(SAR)validatedbythecorporateofficialorKMPofthecompanythatisseekingthefingerprintservicesfromtheprovider.
ElectronicFingerprintCaptureforIndustry
7
6.0Funding
SWFTisafullyoperationalsystemthatisfunded,managedandoperatedbytheDefenseManpowerDataCenter(DMDC).Themajorfundingissueforclearedcontractorsimplementingelectronicfingerprintingisthetotalcostofownershipofhardwarethatisneededtoproducetheelectronicfingerprints.Itisrecommendedthatthecompanyevaluateacquisitionandoperatingcostswhendeterminingwhichoptionsbestsuitthecompany’sorganizationalneeds.ItisalsolikelythatcompanieswillseektoaddanycostsassociatedwithnewGovernment‐imposedsecurityrequirementstotheircontractpricesasanequitableadjustment.SingleUser:SWFTisdesignedtoacceptfingerprintsfromSWFTusersandregisteredequipment.ASWFTusermaybeassociatedwithmultipleCAGECodes(e.g.,CageCodesofsubsidiariesofalargecompany).Thisensuresthatfingerprintsarereceivedfromatrustedsourceusingapprovedequipment.MultipleUsers:Ifmultipleusersshareequipment,theequipmentwillbetestedonlyonce.TheuserswillhavetodevelopasystemthatwillhelpthemtokeepthefingerprintsseparatedbetweenindividualcompaniesandCAGEcodes,andassistwithindustrybilling.
7.0TechnicalSupport
TheDMDCSWFTteamprovidessupportforregisteringequipment,coordinatingtestactivities,andassistingwithdatadiscrepancyresolution.AllotherSWFTinquiriesshouldberoutedthroughtheDoDSecurityServicesCenterortelephone(888)282‐7682.TheSWFTSupportTeamdoesnotprovidetechnicalassistanceforhardwaredevices.Thistypeofsupportwillcomefromtheequipmentsupplierorhardwaremanufacturer.ASWFTconfigurationguideisavailabletoregisteredusersoncetheyloginintotheSWFTsystemanddownloaditfromtheHelpmenu.
ElectronicFingerprintCaptureforIndustry
8
AppendixA
FrequentlyAskedQuestionsQUESTIONSANDANSWERS:Thefollowingquestionsandanswersareinresponsetoqueriesoranticipatedqueriesregardingtherequirementtotransitiontoelectronicfingerprintsubmissionforpersonnelsecurityinvestigations:Q:Whyisthischange(electronicsubmissionoffingerprints)beingmandated?A:Manuallycapturingandsubmittingfingerprintsistimeconsumingandpronetoerrors.Theintentistoutilizeautomatedelectronicfingerprintdevicestospeedcapture,submission,andprocessingtime.Additionally,thistransitionwillsupportgoalsestablishedbytheIntelligenceReformandTerrorismPreventionActof2004andtheimplementationofHomelandSecurityPresidentialDirective‐12.Q:Howcanaclearedcompanyknowwhatspecificequipmenttopurchase?A:TheFBImaintainsalistofproductscertifiedastestedandcompliantwiththeFBI'sNextGenerationIdentification(NGI)initiativesandIntegratedAutomatedFingerprintIdentificationSystem(IAFIS)ImageQualitySpecifications(IQS).TheFBICriminalJusticeInformationServicesDivisionBiometricServicesSection,aspartofBiometricCenterofExcellence,certifiestheseproducts.Q:WhatisSWFT?A:SWFTisSecureWebFingerprintTransmission.SWFTprovidescompaniesparticipatingin,orapplyingtoparticipatein,theNationalIndustrialSecurityProgramtheabilitytotransmitfingerprintfileselectronicallythroughsecurewebservices.Theprocessallowsfingerprintimagestobecapturedelectronically,uploadedtoacentralcollectionpoint(SWFTserver),andthenreleasedfromtheSWFTsystemtoOPMandroutedtotheFBI.DSShasdesignatedSWFTastheonlymethodforsubmittingelectronicfingerprintstoOPMinassociationwithabackgroundinvestigationforNISPparticipants.Q:WhyuseSWFT?A:OPMisthepersonnelsecurityinvestigativeserviceproviderforDoDandchannelsthefingerprintstotheFBIinordertoreceivetheresultsfromtherecordandnamechecksinconjunctionwithbackgroundinvestigations.SWFTwasdevelopedtoprovideIndustrywithastreamlinedprocessandtraceabilityofelectronicfingerprintsubmissions.Furthermore,theDefenseSecurityServicesubmitsthepersonnelsecurityinvestigationrequesttoOPMonbehalfofIndustryandpaysforthecostassociatedwithcompletingtheinvestigation.Sincefingerprintcheckresultsarearequiredelementforallinitialpersonnelsecurityinvestigations,theservicefeeassociatedwiththesubmissionisfundedbyDSSaswell.
ElectronicFingerprintCaptureforIndustry
9
Q:HowsooncanclearedfacilitiestransitiontosubmittingelectronicfingerprintstoSWFTmethod?A:AnyclearedfacilitycanbeginthetransitiontoSWFTimmediatelyusinganyoftheoptionslistedinparagraph2.0.SWFTisafullyoperationalsystemthatisfunded,managedandoperatedbyDefenseManpowerDataCenter(DMDC).Q:Whatarethechallenges?A:TheUSD‐ImemorandumdatedJuly29,2010mandatesthatfingerprintsmustbesubmittedelectronicallyforallbackgroundinvestigationsbyDecember2013.Resourceissuescoulddelaydeployment,whichcouldincludeavailabilityofequipment,registrationprocessing,machinetesting,andusertraining.Q:Ourcompanyhasbeenassignedover10differentCAGEcodes,buthasonlytwocentralprocessingstationsinseparatelocations.Whichoptionisoptimalforourcompany,andhowwilltheprocessactuallywork?A:Therearetwowayshowacentralprocessingstationcouldbeengagedinprocessingandsubmissionofe‐FingerprintstoSWFT:1.CompanyAownsoneormoreelectronicfingerprintcapture/hardcopyscandevices,whichhavebeenregisteredwithOPMandSWFT.Theuseraccountofthecentralprocessingstationstaffmember(e.g.,FSO)isnotonlyassociatedwiththeCAGECodeofCompanyA,butalsowithCAGECodesofthecompany’sbranchesB,C,D,etc.Subject((i.e.,theclearanceapplicant)fromCompanyAoranyofitsbranchescomestothecentralprocessingstation,hasthefingerprintsscanned,andthee‐Fingerprintisgenerated.TheFSOthenlogsintotheSWFTsystemandselectstheCAGECodethatwillbeusedinthissession.ThentheFSOuploadstoSWFTalle‐FingerprintsthatareassociatedwiththeselectedCAGECode.Thesameprocesswillbeusedtosubmite‐FingerprintsforanyotherCAGECodethattheFSOhasbeenregisteredtouse.Alargecompanymaychoosetosubmite‐FingerprintsfortheirsubsidiariesunderasingleCAGECode.2.CompanyAownsoneormorecomputer/scannersystems,whichhavebeenregisteredwithOPMandSWFT.Theuseraccountofthecentralprocessingstationstaffmember(e.g.,FSO)isassociatedonlywiththeCAGECodeofCompanyA.IfthecompanyhasmultiplebranchesB,C,D,etc.,thentheirFSOsestablishtheirownSWFTuseraccount.SubjectfromCompanyAoranyofitsbranchescomestothecentralprocessingstation,hasthefingerprintsscanned,andthee‐Fingerprintisgenerated.ThestaffmemberoftheappropriatecompanyorbranchlaterlogsintotheSWFTsystemfromanysecurelocation(itdoesn’thavetobecollocatedwiththecentralprocessingstation),anduploadsthee‐FingerprinttoSWFT.
ElectronicFingerprintCaptureforIndustry
10
Q:TheSWFTsupportsmultipleCAGEcodes,butthevendorwhosupportsourfingerprintscanneradvisedusthattheyhavenotyetintegratedmultipleCAGEcodesintheirsoftware.HowcanourFSOuploade‐FingerprintsformultipleCAGEcodes?A:TheSWFTsystemonlyregisterstheCAGECodesofitsusers(e.g.,FSOs)tosupporttheuploadofe‐FingerprintfilesandviewreportstiedtoCAGECodes.ThisisintendedtoprovidesecurityandaccountabilityforthePIIuploadedandstoredinSWFT.Theprocessofgeneratingthee‐Fingerprintfiles(actiontakenonafingerprintscanner)andtheprocessofuploadingthee‐FingerprinttoSWFT(actiontakenonanycomputerwithwebbrowser)aretwoseparate,asynchronousandindependentprocesses.TheFSOfirstscansaperson'sfingerprintandgeneratesthee‐Fingerprintfile.Thisprocesscanberepeatedformultiplepersonsasneeded.Later,theFSOlogsintotheSWFTsystemfromanysecurelocation(itdoesnothavetobecollocatedwiththefingerprintscanner),anduploadsthee‐FingerprintstoSWFT.
ElectronicFingerprintCaptureforIndustry
11
AppendixB
References
USD(I)memo,DoDTransitiontoElectronicFingerprintCaptureandSubmissioninSupportofBackgroundInvestigations,datedJuly29,2010:e‐Fingerprintmemo
SecureWebFingerprintTransmission(SWFT)programavailablenow:
o Homepage:https://www.dmdc.osd.mil/psawebdocs/docPage.jsp?p=SWFTo SWFTProgramManagerEmail:dodhra.dodc‐[email protected] Registration,AccessandTestingProcedures:
https://www.dmdc.osd.mil/psawebdocs/docRequest//filePathNm=PSA/appId=560/app_key_id=1559jsow24d/siteId=7/ediPnId=0/userId=public/fileNm=SWFT+Access+Registration+and+Testing+Procedures+v1.1.pdf
FBIApprovedList:o FBI‐CertifiedProducts:https://www.fbibiospecs.org/IAFIS/Default.aspx
FBIApprovedChannelerList:
o FBIApprovedChannelers:http://www.fbi.gov/about‐us/cjis/background‐checks/list‐of‐fbi‐approved‐channelers
DoDSecurityServicesCenter:o CustomerServiceHours:6:00AM–8:00PMEST,MondaythroughFriday
(excludingfederalholidays)o Toll‐FreeTelephone:(888)282‐7682o Website:http://www.dss.mil/about_dss/contact_dss/contact_dss.html
ElectronicFingerprintCaptureforIndustry
12
AppendixC
TheSecretaryofDefensehasenteredintoagreementswiththedepartmentsandagencieslistedbelowforthepurposeofrenderingindustrialsecurityservices:
1. DepartmentofAgriculture
2. DepartmentofCommerce
3. DepartmentofEducation
4. DepartmentofHealthandHumanServices
5. DepartmentofHomelandSecurity
6. DepartmentofJustice
7. DepartmentofLabor
8. DepartmentofState
9. DepartmentofInterior
10. DepartmentofTransportation
11. DepartmentofTreasury
12. EnvironmentalProtectionAgency
13. FederalCommunicationsCommission
14. FederalReserveSystem
15. GeneralServicesAdministration
16. GovernmentAccountabilityOffice
17. NationalAeronauticsandSpaceAdministration
18. NationalScienceFoundation
19. NuclearRegulatoryCommission
20. OfficeofPersonnelManagement
21. SmallBusinessAdministration
22. UnitedStatesAgencyforInternationalDevelopment
23. UnitedStatesInternationalTradeCommission
24. UnitedStatesTradeRepresentative